www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1701:a964:c08d:f5eb:b0c  Public Scan

URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Submission: On November 13 via api from DE — Scanned from US

Summary

This website contacted 73 IPs in 2 countries across 63 domains to perform 187 HTTP transactions. The main IP is 2600:1f18:1492:1701:a964:c08d:f5eb:b0c, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 156385.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 16th 2024. Valid for: a year.
This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
37 2600:1f18:149... 14618 (AMAZON-AES)
6 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
22 2600:141b:1c0... 20940 (AKAMAI-ASN1)
1 4 34.197.160.137 14618 (AMAZON-AES)
1 54.146.68.25 14618 (AMAZON-AES)
1 1 34.204.233.191 14618 (AMAZON-AES)
1 63.140.39.240 14618 (AMAZON-AES)
4 104.19.148.8 13335 (CLOUDFLAR...)
12 23.196.3.199 20940 (AKAMAI-ASN1)
2 23.199.37.208 16625 (AKAMAI-AS)
2 35.245.15.98 396982 (GOOGLE-CL...)
3 2620:1ec:33:1... 8075 (MICROSOFT...)
2 2607:f8b0:400... 15169 (GOOGLE)
1 23.51.57.192 16625 (AKAMAI-AS)
2 64.202.112.159 22075 (AS-OUTBRAIN)
1 2600:141b:1c0... 20940 (AKAMAI-ASN1)
2 3.13.136.49 16509 (AMAZON-02)
2 99.83.231.3 16509 (AMAZON-02)
2 2a02:6ea0:c45... 60068 (CDN77 _)
1 2607:f8b0:400... 15169 (GOOGLE)
1 63.140.38.112 14618 (AMAZON-AES)
1 2606:4700:310... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 52.32.164.86 16509 (AMAZON-02)
3 2620:1ec:29:1... 8075 (MICROSOFT...)
1 216.200.232.253 30419 (PAEDAE-INC)
2 34.111.208.231 396982 (GOOGLE-CL...)
1 2a04:4e42::485 54113 (FASTLY)
2 44.226.187.177 16509 (AMAZON-02)
1 54.203.236.163 16509 (AMAZON-02)
22 25 34.150.170.96 396982 (GOOGLE-CL...)
1 1 2600:9000:284... 16509 (AMAZON-02)
1 52.202.124.0 14618 (AMAZON-AES)
1 69.194.240.13 26120 (RHYTHMONE)
1 2 35.71.139.29 16509 (AMAZON-02)
1 2600:1f18:612... 14618 (AMAZON-AES)
3 4 34.111.113.62 396982 (GOOGLE-CL...)
1 1 108.138.128.14 16509 (AMAZON-02)
1 1 2600:9000:21f... 16509 (AMAZON-02)
1 2 2600:9000:207... 16509 (AMAZON-02)
1 8.28.7.83 62713 (AS-PUBMATIC)
1 63.251.28.210 13789 (INTERNAP-...)
2 3 2600:1901:0:8... 15169 (GOOGLE)
3 4 2001:4998:1c:... 14779 (YAHOO)
1 2 52.0.156.250 14618 (AMAZON-AES)
1 44.208.126.163 14618 (AMAZON-AES)
1 23.197.253.128 16625 (AKAMAI-AS)
1 2 35.175.35.80 14618 (AMAZON-AES)
1 2 54.166.218.157 14618 (AMAZON-AES)
3 3 35.244.154.8 396982 (GOOGLE-CL...)
1 1 107.178.254.65 15169 (GOOGLE)
5 8 2620:1ec:21::14 8068 (MICROSOFT...)
1 1 142.250.65.226 15169 (GOOGLE)
1 1 142.251.35.162 15169 (GOOGLE)
1 142.251.40.100 15169 (GOOGLE)
4 6 68.67.179.155 29990 (ASN-APPNEX)
1 2 69.173.146.5 26667 (RUBICONPR...)
1 2 35.244.159.8 15169 (GOOGLE)
4 4 172.217.165.130 15169 (GOOGLE)
1 44.209.137.118 14618 (AMAZON-AES)
1 151.101.44.157 54113 (FASTLY)
1 2600:141b:b00... 20940 (AKAMAI-ASN1)
6 52.44.251.75 14618 (AMAZON-AES)
2 3 68.67.179.153 29990 (ASN-APPNEX)
1 2600:9000:21f... 16509 (AMAZON-02)
3 172.66.0.227 13335 (CLOUDFLAR...)
3 104.244.42.67 13414 (TWITTER)
1 52.22.50.55 14618 (AMAZON-AES)
1 13.107.42.14 8068 (MICROSOFT...)
1 2 142.251.41.6 15169 (GOOGLE)
2 31.13.71.7 32934 (FACEBOOK)
1 172.67.163.237 13335 (CLOUDFLAR...)
1 6 34.117.77.79 396982 (GOOGLE-CL...)
1 52.70.150.194 14618 (AMAZON-AES)
2 2a03:2880:f11... 32934 (FACEBOOK)
8 9 15.197.193.217 16509 (AMAZON-02)
2 3 54.156.26.12 14618 (AMAZON-AES)
2 52.89.99.220 16509 (AMAZON-02)
1 35.81.162.201 16509 (AMAZON-02)
1 54.244.159.189 16509 (AMAZON-02)
187 73
Apex Domain
Subdomains
Transfer
38 fortinet.com
www.fortinet.com — Cisco Umbrella Rank: 156385
metrics.fortinet.com — Cisco Umbrella Rank: 444136
4 MB
27 simpli.fi
tag.simpli.fi — Cisco Umbrella Rank: 6380
i.simpli.fi — Cisco Umbrella Rank: 5203
um.simpli.fi — Cisco Umbrella Rank: 1072
15 KB
22 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 468
152 KB
15 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6855
c.6sc.co — Cisco Umbrella Rank: 8270
ipv6.6sc.co — Cisco Umbrella Rank: 6936
b.6sc.co — Cisco Umbrella Rank: 4441
eps.6sc.co — Cisco Umbrella Rank: 10972
22 KB
9 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 426
insight.adsrvr.org — Cisco Umbrella Rank: 1228
7 KB
9 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 302
secure.adnxs.com — Cisco Umbrella Rank: 576
10 KB
9 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 404
www.linkedin.com — Cisco Umbrella Rank: 705
px4.ads.linkedin.com — Cisco Umbrella Rank: 6892
5 KB
7 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 52
cm.g.doubleclick.net — Cisco Umbrella Rank: 294
10104846.fls.doubleclick.net — Cisco Umbrella Rank: 485898
2 KB
6 ml314.com
ml314.com — Cisco Umbrella Rank: 2086
40 KB
6 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 3122
10 KB
6 crazyegg.com
script.crazyegg.com — Cisco Umbrella Rank: 3180
tracking.crazyegg.com — Cisco Umbrella Rank: 5448
41 KB
6 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 390
127 KB
5 outbrain.com
amplify.outbrain.com — Cisco Umbrella Rank: 3713
wave.outbrain.com — Cisco Umbrella Rank: 4615
tr.outbrain.com — Cisco Umbrella Rank: 3598
11 KB
5 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 276
fortinet.demdex.net — Cisco Umbrella Rank: 482817
3 KB
4 mountain.com
dx.mountain.com — Cisco Umbrella Rank: 5404
px.mountain.com — Cisco Umbrella Rank: 5644
gs.mountain.com — Cisco Umbrella Rank: 11087
11 KB
4 yahoo.com
cms.analytics.yahoo.com — Cisco Umbrella Rank: 2476
ups.analytics.yahoo.com — Cisco Umbrella Rank: 599
1 KB
4 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 495
1 KB
3 eyeota.net
ps.eyeota.net — Cisco Umbrella Rank: 1387
2 KB
3 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 1085
701 B
3 t.co
t.co — Cisco Umbrella Rank: 872
1 KB
3 rlcdn.com
idsync.rlcdn.com — Cisco Umbrella Rank: 519
853 B
3 pro-market.net
fei.pro-market.net — Cisco Umbrella Rank: 3231
pbid.pro-market.net — Cisco Umbrella Rank: 12555
1 KB
3 contanuity.com
intentstream.contanuity.com — Cisco Umbrella Rank: 101692
tracking.contanuity.com — Cisco Umbrella Rank: 24288
1 KB
3 argusplatform.com
tmp.argusplatform.com — Cisco Umbrella Rank: 483741
pixels.argusplatform.com — Cisco Umbrella Rank: 472744
webtracker.argusplatform.com — Cisco Umbrella Rank: 483874
4 KB
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 35916
ibc-flow.techtarget.com — Cisco Umbrella Rank: 30831
2 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 397
15 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 120
4 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 208
74 KB
2 openx.net
us-u.openx.net — Cisco Umbrella Rank: 593
502 B
2 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 459
3 KB
2 lijit.com
ce.lijit.com — Cisco Umbrella Rank: 1257
898 B
2 crwdcntrl.net
bcp.crwdcntrl.net — Cisco Umbrella Rank: 1277
835 B
2 exelator.com
loadm.exelator.com — Cisco Umbrella Rank: 2703
2 KB
2 intentiq.com
sync.intentiq.com — Cisco Umbrella Rank: 1297
2 KB
2 agkn.com
aa.agkn.com — Cisco Umbrella Rank: 617
d.agkn.com — Cisco Umbrella Rank: 866
1 KB
2 3lift.com
eb2.3lift.com — Cisco Umbrella Rank: 481
970 B
2 demandscience.com
abm-tracking.demandscience.com — Cisco Umbrella Rank: 97241
3 KB
2 omappapi.com
a.omappapi.com — Cisco Umbrella Rank: 7398
api.omappapi.com — Cisco Umbrella Rank: 7432
3 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 64
177 KB
1 steelhousemedia.com
px.steelhousemedia.com — Cisco Umbrella Rank: 15797
319 B
1 siteimproveanalytics.io
6033413.global.siteimproveanalytics.io — Cisco Umbrella Rank: 452057
149 B
1 siteimproveanalytics.com
siteimproveanalytics.com — Cisco Umbrella Rank: 5098
12 KB
1 inzynk.io
tags.inzynk.io — Cisco Umbrella Rank: 313829
441 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 1142
14 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 1236
16 KB
1 google.com
www.google.com — Cisco Umbrella Rank: 4
64 B
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 110
23 B
1 pippio.com
pippio.com — Cisco Umbrella Rank: 947
633 B
1 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 2756
27 B
1 bfmio.com
sync.bfmio.com — Cisco Umbrella Rank: 1727
421 B
1 stickyadstv.com
ads.stickyadstv.com — Cisco Umbrella Rank: 685
656 B
1 pubmatic.com
image2.pubmatic.com — Cisco Umbrella Rank: 1092
552 B
1 tremorhub.com
simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 8215
175 B
1 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 566
99 B
1 sharethrough.com
match.sharethrough.com — Cisco Umbrella Rank: 585
324 B
1 smaato.net
s.ad.smaato.net — Cisco Umbrella Rank: 649
550 B
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 331
14 KB
1 mathtag.com
pixel.mathtag.com — Cisco Umbrella Rank: 4421
712 B
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 65
1 opmnstr.com
a.opmnstr.com — Cisco Umbrella Rank: 38980
17 KB
1 omtrdc.net
fortinet.tt.omtrdc.net — Cisco Umbrella Rank: 465451
832 B
1 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 1776
490 B
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 610
306 B
187 63
Domain Requested by
37 www.fortinet.com www.fortinet.com
25 um.simpli.fi 22 redirects
22 assets.adobedtm.com cdn.cookielaw.org
assets.adobedtm.com
10 b.6sc.co www.fortinet.com
8 match.adsrvr.org 7 redirects
7 px.ads.linkedin.com 4 redirects snap.licdn.com
6 ml314.com 1 redirects www.fortinet.com
ml314.com
6 tags.srv.stackadapt.com www.fortinet.com
tags.srv.stackadapt.com
6 ib.adnxs.com 4 redirects
6 cdn.cookielaw.org www.fortinet.com
cdn.cookielaw.org
4 cm.g.doubleclick.net 4 redirects
4 pixel.tapad.com 3 redirects
4 script.crazyegg.com www.fortinet.com
script.crazyegg.com
4 dpm.demdex.net 1 redirects www.fortinet.com
3 ps.eyeota.net 2 redirects
3 analytics.twitter.com
3 t.co
3 secure.adnxs.com 2 redirects
3 idsync.rlcdn.com 3 redirects
3 ups.analytics.yahoo.com 2 redirects
3 bat.bing.com assets.adobedtm.com
bat.bing.com
www.fortinet.com
2 px.mountain.com dx.mountain.com
px.mountain.com
2 www.facebook.com
2 connect.facebook.net www.fortinet.com
connect.facebook.net
2 10104846.fls.doubleclick.net 1 redirects assets.adobedtm.com
2 us-u.openx.net 1 redirects
2 pixel.rubiconproject.com 1 redirects
2 ce.lijit.com 1 redirects
2 bcp.crwdcntrl.net 1 redirects
2 loadm.exelator.com 1 redirects
2 fei.pro-market.net 2 redirects
2 sync.intentiq.com 1 redirects
2 eb2.3lift.com 1 redirects
2 intentstream.contanuity.com abm-tracking.demandscience.com
2 ibc-flow.techtarget.com trk.techtarget.com
2 abm-tracking.demandscience.com www.fortinet.com
abm-tracking.demandscience.com
2 eps.6sc.co j.6sc.co
2 tracking.crazyegg.com script.crazyegg.com
2 tr.outbrain.com amplify.outbrain.com
2 www.googletagmanager.com assets.adobedtm.com
abm-tracking.demandscience.com
2 amplify.outbrain.com www.fortinet.com
amplify.outbrain.com
1 insight.adsrvr.org 1 redirects
1 px.steelhousemedia.com
1 gs.mountain.com px.mountain.com
1 6033413.global.siteimproveanalytics.io
1 webtracker.argusplatform.com tmp.argusplatform.com
1 siteimproveanalytics.com assets.adobedtm.com
1 px4.ads.linkedin.com
1 www.linkedin.com 1 redirects
1 tags.inzynk.io assets.adobedtm.com
1 snap.licdn.com www.fortinet.com
1 static.ads-twitter.com www.fortinet.com
1 dx.mountain.com www.fortinet.com
1 www.google.com
1 googleads.g.doubleclick.net 1 redirects
1 www.googleadservices.com 1 redirects
1 pippio.com 1 redirects
1 stags.bluekai.com
1 sync.bfmio.com
1 pbid.pro-market.net
1 cms.analytics.yahoo.com 1 redirects
1 ads.stickyadstv.com
1 image2.pubmatic.com
1 d.agkn.com 1 redirects
1 aa.agkn.com 1 redirects
1 simplifi.partners.tremorhub.com
1 sync.1rx.io
1 match.sharethrough.com
1 s.ad.smaato.net 1 redirects
1 i.simpli.fi tag.simpli.fi
1 pixels.argusplatform.com tmp.argusplatform.com
1 tracking.contanuity.com abm-tracking.demandscience.com
www.fortinet.com
1 cdn.jsdelivr.net abm-tracking.demandscience.com
1 pixel.mathtag.com www.fortinet.com
1 tmp.argusplatform.com www.fortinet.com
1 trk.techtarget.com www.fortinet.com
1 api.omappapi.com a.opmnstr.com
1 a.omappapi.com a.opmnstr.com
1 metrics.fortinet.com www.fortinet.com
1 www.google-analytics.com www.googletagmanager.com
1 a.opmnstr.com assets.adobedtm.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 wave.outbrain.com amplify.outbrain.com
1 tag.simpli.fi assets.adobedtm.com
1 j.6sc.co www.fortinet.com
1 fortinet.tt.omtrdc.net www.fortinet.com
1 cm.everesttech.net 1 redirects
1 fortinet.demdex.net www.fortinet.com
1 geolocation.onetrust.com cdn.cookielaw.org
187 90
Subject Issuer Validity Valid
*.fortinet.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-07-16 -
2025-07-15
a year crt.sh
cookielaw.org
WE1
2024-10-11 -
2025-01-09
3 months crt.sh
geolocation.onetrust.com
WE1
2024-10-11 -
2025-01-09
3 months crt.sh
assets.adobedtm.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-07-09 -
2025-08-09
a year crt.sh
*.demdex.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-09-25 -
2025-10-26
a year crt.sh
*.tt.omtrdc.net
DigiCert TLS RSA SHA256 2020 CA1
2024-02-26 -
2025-03-28
a year crt.sh
script.crazyegg.com
Cloudflare Inc ECC CA-3
2024-08-02 -
2024-12-31
5 months crt.sh
6sc.co
R10
2024-09-23 -
2024-12-22
3 months crt.sh
*.outbrain.com
DigiCert TLS RSA SHA256 2020 CA1
2023-12-14 -
2024-12-14
a year crt.sh
*.simpli.fi
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-11-07 -
2024-12-07
a year crt.sh
www.bing.com
Microsoft Azure RSA TLS Issuing CA 03
2024-09-16 -
2025-03-15
6 months crt.sh
*.google-analytics.com
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
crazyegg.com
Amazon RSA 2048 M02
2024-06-30 -
2025-07-30
a year crt.sh
eps.6sc.co
Amazon RSA 2048 M03
2024-08-27 -
2025-09-25
a year crt.sh
a.opmnstr.com
R11
2024-11-05 -
2025-02-03
3 months crt.sh
metrics.fortinet.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-12-26 -
2025-01-25
a year crt.sh
a.omappapi.com
R10
2024-11-05 -
2025-02-03
3 months crt.sh
omappapi.com
WE1
2024-10-12 -
2025-01-10
3 months crt.sh
trk.techtarget.com
WE1
2024-09-20 -
2024-12-19
3 months crt.sh
abm-tracking.demandscience.com
R10
2024-10-13 -
2025-01-11
3 months crt.sh
tmp.argusplatform.com
GeoTrust Global TLS RSA4096 SHA256 2022 CA1
2024-09-09 -
2025-03-09
6 months crt.sh
*.mathtag.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-04-23 -
2025-04-30
a year crt.sh
ibc-flow.techtarget.com
WR3
2024-10-24 -
2025-01-22
3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2024 Q3
2024-07-30 -
2025-08-31
a year crt.sh
intentstream.contanuity.com
E5
2024-10-14 -
2025-01-12
3 months crt.sh
tracking.contanuity.com
R11
2024-11-11 -
2025-02-09
3 months crt.sh
pixels.argusplatform.com
GeoTrust Global TLS RSA4096 SHA256 2022 CA1
2024-09-08 -
2025-03-08
6 months crt.sh
*.mountain.com
Go Daddy Secure Certificate Authority - G2
2024-05-23 -
2025-06-24
a year crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-06-25 -
2025-06-24
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-12-13 -
2024-12-12
a year crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M03
2024-08-09 -
2025-09-06
a year crt.sh
*.inzynk.io
Amazon RSA 2048 M02
2024-01-07 -
2025-02-04
a year crt.sh
t.co
E5
2024-09-28 -
2024-12-27
3 months crt.sh
*.twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-10-07 -
2025-10-06
a year crt.sh
52.22.50.55
Sectigo RSA Domain Validation Secure Server CA
2024-01-26 -
2025-02-14
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2024-10-14 -
2025-04-14
6 months crt.sh
*.doubleclick.net
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2024-08-22 -
2024-11-20
3 months crt.sh
siteimproveanalytics.com
WE1
2024-10-17 -
2025-01-15
3 months crt.sh
event-horizon.gcp.bomm.in
WR3
2024-10-18 -
2025-01-16
3 months crt.sh
webtracker.argusplatform.com
GeoTrust Global TLS RSA4096 SHA256 2022 CA1
2024-09-09 -
2025-03-09
6 months crt.sh
*.global.r1.siteimproveanalytics.io
Amazon RSA 2048 M02
2024-09-02 -
2025-10-01
a year crt.sh

This page contains 3 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Frame ID: 9D6198AA08FCDAD7493B829B517C33F5
Requests: 183 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 3BB251957DDBFB3734D0EA94B8C82AFE
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=CITQ39TM2YkDFTOMywEdQmstcg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4350436164737.9277
Frame ID: AB89630792213C598E87DF4328FA0CA2
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

New Campaign Uses Remcos RAT to Exploit Victims | FortiGuard Labs

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc/designs/
  • /etc\.clientlibs/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • /fingerprintjs@(\d)

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

Overall confidence: 100%
Detected patterns
  • tracker\.js

Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

187
Requests

82 %
HTTPS

28 %
IPv6

63
Domains

90
Subdomains

73
IPs

2
Countries

4598 kB
Transfer

7067 kB
Size

123
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47
  • https://cm.everesttech.net/cm/dd?d_uuid=63294759403938320303313056908800215410 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZzTCVgAAAMGZugN2
Request Chain 97
  • https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1731510872543 HTTP 303
  • https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1731510872543&_bee_ppp=1 HTTP 303
  • https://tracking.contanuity.com/usersync?bwcookie=AAJRv07OaYUAABZ936JzlA
Request Chain 118
  • https://um.simpli.fi/smaato HTTP 302
  • https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=EBC60905896D45418C0F1FB7F86AC98D HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=b1d8034279&gdpr=0&gdpr_consent=
Request Chain 119
  • https://um.simpli.fi/nexxen HTTP 302
  • https://sync.1rx.io/usersync/simplifi/EBC60905896D45418C0F1FB7F86AC98D
Request Chain 120
  • https://um.simpli.fi/triplelift HTTP 302
  • https://eb2.3lift.com/xuid?mid=7969&xuid=EBC60905896D45418C0F1FB7F86AC98D&dongle=yf3 HTTP 302
  • https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=EBC60905896D45418C0F1FB7F86AC98D&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Request Chain 121
  • https://um.simpli.fi/telaria_p HTTP 302
  • https://simplifi.partners.tremorhub.com/sync?UISF=EBC60905896D45418C0F1FB7F86AC98D
Request Chain 122
  • https://um.simpli.fi/tapad HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=EBC60905896D45418C0F1FB7F86AC98D HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=EBC60905896D45418C0F1FB7F86AC98D
Request Chain 123
  • https://um.simpli.fi/ad_advisor HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=EBC60905896D45418C0F1FB7F86AC98D HTTP 302
  • https://d.agkn.com/pixel/10751/?che=1731510873974&ip=38.132.118.70&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D214530605065014038469 HTTP 302
  • https://um.simpli.fi/aa_px?sk=214530605065014038469 HTTP 302
  • https://um.simpli.fi/empty.gif
Request Chain 124
  • https://um.simpli.fi/intentiq HTTP 302
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EBC60905896D45418C0F1FB7F86AC98D HTTP 302
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EBC60905896D45418C0F1FB7F86AC98D&ckls=true&ci=KRUk79Xjqm&nc=false&trid=699923177
Request Chain 125
  • https://um.simpli.fi/pubmatic HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:EBC60905896D45418C0F1FB7F86AC98D
Request Chain 126
  • https://um.simpli.fi/freewheel HTTP 302
  • https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=EBC60905896D45418C0F1FB7F86AC98D
Request Chain 127
  • https://um.simpli.fi/dtnx HTTP 302
  • https://fei.pro-market.net/engine?du=24;csync=EBC60905896D45418C0F1FB7F86AC98D;mimetype=img; HTTP 302
  • https://fei.pro-market.net/engine?du=24;csync=EBC60905896D45418C0F1FB7F86AC98D;mimetype=img;sr HTTP 302
  • https://cms.analytics.yahoo.com/cms?partner_id=DATCS HTTP 302
  • https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS HTTP 302
  • https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-txtbMrdE2pTZ9W5Me5vq2bLhmOZjy.k1FVQ-~A
Request Chain 128
  • https://um.simpli.fi/exelatem HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=2191&simid=EBC60905896D45418C0F1FB7F86AC98D&j=0 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=2191&simid=EBC60905896D45418C0F1FB7F86AC98D&j=0&xl8blockcheck=1
Request Chain 129
  • https://um.simpli.fi/yahoo HTTP 302
  • https://ups.analytics.yahoo.com/ups/55964/sync?uid=EBC60905896D45418C0F1FB7F86AC98D HTTP 302
  • https://ups.analytics.yahoo.com/ups/55964/sync?uid=EBC60905896D45418C0F1FB7F86AC98D&verify=true
Request Chain 130
  • https://um.simpli.fi/beachfront HTTP 302
  • https://sync.bfmio.com/sync?pid=141&uid=EBC60905896D45418C0F1FB7F86AC98D
Request Chain 131
  • https://um.simpli.fi/bluekai HTTP 302
  • https://stags.bluekai.com/site/29931?id=EBC60905896D45418C0F1FB7F86AC98D
Request Chain 132
  • https://um.simpli.fi/crwdcntrl HTTP 302
  • https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=EBC60905896D45418C0F1FB7F86AC98D HTTP 302
  • https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=EBC60905896D45418C0F1FB7F86AC98D
Request Chain 133
  • https://um.simpli.fi/lj_match HTTP 302
  • https://ce.lijit.com/merge?pid=2&3pid=EBC60905896D45418C0F1FB7F86AC98D HTTP 302
  • https://ce.lijit.com/merge?pid=2&3pid=EBC60905896D45418C0F1FB7F86AC98D&dnr=1
Request Chain 134
  • https://um.simpli.fi/liveramp_match HTTP 302
  • https://idsync.rlcdn.com/419566.gif?partner_uid=EBC60905896D45418C0F1FB7F86AC98D HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogRUJDNjA5MDU4OTZENDU0MThDMEYxRkI3Rjg2QUM5OEQQABoNCNqE07kGEgUI6AcQAEIASgA HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=8cdee6c7edd11c2e1f2e4652504c99a774ef975e5f420af4f84ae1c390da9028791426b5417dce21&_=2 HTTP 307
  • https://px.ads.linkedin.com/db_sync?pid=10339&puuid=8cdee6c7edd11c2e1f2e4652504c99a774ef975e5f420af4f84ae1c390da9028791426b5417dce21&rand=08978028 HTTP 302
  • https://px.ads.linkedin.com/db_sync?pid=10339&puuid=8cdee6c7edd11c2e1f2e4652504c99a774ef975e5f420af4f84ae1c390da9028791426b5417dce21&rand=08978028&expected_cookie=69c93d21-9e4d-4fad-ba7b-1141f0b75d1e
Request Chain 135
  • https://www.googleadservices.com/pagead/conversion/1026675585/?random=1731510873508&cv=7&fst=1731510873508&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1487343483&cv=7&fst=1731510873508&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOrGsQIIo8WxAgjTxbECCKXGsQI&pscrd=IhMIvbe01MzZiQMVtzmICR3-kD0aMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v HTTP 302
  • https://www.google.com/pagead/1p-conversion/1026675585/?random=1487343483&cv=7&fst=1731510873508&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOrGsQIIo8WxAgjTxbECCKXGsQI&pscrd=IhMIvbe01MzZiQMVtzmICR3-kD0aMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSGwCa7L7dJgZTEV2LT3Ed64knzkzUvG2GkFQq_Q&random=2429023288
Request Chain 137
  • https://um.simpli.fi/an HTTP 302
  • https://ib.adnxs.com/setuid?entity=66&code=EBC60905896D45418C0F1FB7F86AC98D HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DEBC60905896D45418C0F1FB7F86AC98D
Request Chain 138
  • https://um.simpli.fi/rb_match HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=EBC60905896D45418C0F1FB7F86AC98D&expires=365
Request Chain 139
  • https://um.simpli.fi/ox_match HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072966&val=EBC60905896D45418C0F1FB7F86AC98D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=EBC60905896D45418C0F1FB7F86AC98D
Request Chain 140
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm=&google_sc=&google_tc= HTTP 302
  • https://um.simpli.fi/g_match?id=&google_gid=CAESEG_u-t0pKzu7FLCo7Wibd-4&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=EBC60905896D45418C0F1FB7F86AC98D HTTP 302
  • https://um.simpli.fi/g_match?id=
Request Chain 145
  • https://secure.adnxs.com/px?id=1773420&t=2 HTTP 307
  • https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
Request Chain 146
  • https://ib.adnxs.com/seg?add=36113683 HTTP 307
  • https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
Request Chain 154
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&li_adsId=3d8f9782-d2b9-4b41-8d7a-4f830082a068&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&li_adsId=3d8f9782-d2b9-4b41-8d7a-4f830082a068&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%252C6313418%26time%3D1731510874029%26li_adsId%3D3d8f9782-d2b9-4b41-8d7a-4f830082a068%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fnew-campaign-uses-remcos-rat-to-exploit-victims%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&li_adsId=3d8f9782-d2b9-4b41-8d7a-4f830082a068&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&li_adsId=3d8f9782-d2b9-4b41-8d7a-4f830082a068&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cookiesTest=true&liSync=true&e_ipv6=AQIzeBwyIKAzVAAAAZMmFzHSOrukxvRW4NutgWXFMxNs98EN4jIYSHFk3gVs0pRWIoWxDwY
Request Chain 157
  • https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4350436164737.9277 HTTP 302
  • https://10104846.fls.doubleclick.net/activityi;dc_pre=CITQ39TM2YkDFTOMywEdQmstcg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4350436164737.9277
Request Chain 174
  • https://idsync.rlcdn.com/395886.gif?partner_uid=3648398751723683879 HTTP 307
  • https://ml314.com/csync.ashx?fp=b37450a9963f712bd0006be646cbdc8c953266b97ba039d89cd9b5d54b14a71df4cb09cee1a4f8eb&person_id=3648398751723683879&eid=50082
Request Chain 175
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
  • https://ml314.com/utsync.ashx?eid=53819&et=0&fp=89de1bef-d89c-48c0-b134-0fb937641c1c&gdpr=0&gdpr_consent=
Request Chain 176
  • https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3648398751723683879%26eid=2 HTTP 302
  • https://ml314.com/csync.ashx?fp=6659824704771999787&person_id=3648398751723683879&eid=2
Request Chain 177
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2OaFLlhQwGDBLRPail7L6RNjl55D2KUpZqlhY4sQvtcQ&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Request Chain 184
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=fe8db057-a1d1-11ef-b156-69aed426a8d9&gdpr=&gdpr_consent= HTTP 302
  • https://px.steelhousemedia.com/tdsync?tdid=89de1bef-d89c-48c0-b134-0fb937641c1c&shguid=fe8db057-a1d1-11ef-b156-69aed426a8d9
Request Chain 185
  • https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=89de1bef-d89c-48c0-b134-0fb937641c1c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ODlkZTFiZWYtZDg5Yy00OGMwLWIxMzQtMGZiOTM3NjQxYzFj&gdpr=0&gdpr_consent=&ttd_tdid=89de1bef-d89c-48c0-b134-0fb937641c1c HTTP 302
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=89de1bef-d89c-48c0-b134-0fb937641c1c&google_gid=CAESEDwuRULoW_H2D9fo8hQYkIc&google_cver=1 HTTP 302
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=89de1bef-d89c-48c0-b134-0fb937641c1c HTTP 302
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=6659824704771999787&ttd_tdid=89de1bef-d89c-48c0-b134-0fb937641c1c HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=89de1bef-d89c-48c0-b134-0fb937641c1c&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=89de1bef-d89c-48c0-b134-0fb937641c1c&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad HTTP 302
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D8a111da6-2dc6-437e-99b4-36e0f5eb98ed%252Chttps%25253A%25252F%25252Fmatch.adsrvr.org%25252Ftrack%25252Fcmf%25252Fgeneric%25253Fttd_pid%25253Dtapad%252C HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=6659824704771999787&pt=8a111da6-2dc6-437e-99b4-36e0f5eb98ed%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%252Fgeneric%253Fttd_pid%253Dtapad%2C HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad

187 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request new-campaign-uses-remcos-rat-to-exploit-victims
www.fortinet.com/blog/threat-research/
81 KB
26 KB
Document
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
619a66b171139705014abb66652b93ba67dba872d941be3aa7372ceb08201dbb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Age
782
Cache-Control
max-age=600, public, s-maxage=10800
Connection
keep-alive
Content-Encoding
gzip
Content-Length
24698
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Type
text/html;charset=utf-8
Date
Wed, 13 Nov 2024 15:01:27 GMT
ETag
W/"145bf-626cc9bacfa54-gzip"
Last-Modified
Wed, 13 Nov 2024 15:01:27 GMT
Server
Apache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
Via
1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
X-Amz-Cf-Id
XWe5Rnl2ViCg9X1yj3UPQ6va57j2KbbyHFQf5vcgbjJS5cfPWii-qg==
X-Amz-Cf-Pop
IAD61-P2
X-Cache
Hit from cloudfront
X-Content-Type-Options
nosniff
X-Dispatcher
dispatcher2uswest1-28559771
X-Frame-Options
SAMEORIGIN
X-Vhost
publish
X-XSS-Protection
1; mode=block
visitorapi.min.js
www.fortinet.com/etc/designs/fortinet/adb-target/
64 KB
30 KB
Script
General
Full URL
https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
Content-Encoding
gzip
ETag
"fe2d-6117284c96900-gzip"
Age
397107
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
jBtmlh3kDc-zFgQe6xgZ3wyJSlvBzbEaYMLRvkdT6bzwcU-6s2P_Kg==
Date
Sat, 09 Nov 2024 00:56:02 GMT
Content-Type
application/javascript
Vary
Accept-Encoding
Last-Modified
Thu, 15 Feb 2024 21:43:32 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
29532
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
at.js
www.fortinet.com/etc/designs/fortinet/adb-target/
104 KB
48 KB
Script
General
Full URL
https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
Content-Encoding
gzip
ETag
"19e83-61431fc4b24c0-gzip"
Age
116277
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
QLW7RVrRr-kObyXbsU6ur7NNF51qDr3-HKFVL62tOtc8XE2KoCNgFw==
Date
Tue, 12 Nov 2024 06:56:32 GMT
Content-Type
application/javascript
Vary
Accept-Encoding
Last-Modified
Thu, 21 Mar 2024 20:59:39 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher2uswest1-28559771
Connection
keep-alive
Via
1.1 7c52bc60e0da5f557ed6047264a41c18.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
47782
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/
540 KB
28 KB
Stylesheet
General
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
Content-Encoding
gzip
ETag
"86e1b-61b58998583c0-gzip"
Age
326504
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
9-5z-kb4ve8if17ghgnCRX2ZJ3MIBdIS2r8213WPH3gTHPe2x8ijvQ==
Date
Sat, 09 Nov 2024 20:32:45 GMT
Content-Type
text/css;charset=utf-8
Last-Modified
Thu, 20 Jun 2024 21:00:07 GMT
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher2uswest1-28559771
Connection
keep-alive
Via
1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
27478
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
22 KB
8 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ade920fd5b00cd298aae7978673a9a64d0bb3fa593d23e91994ec6b6723ebace
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-md5
Vo/d0f3ZefkwyML/PnJnjg==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DD02CCC182444E
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
29882
x-content-type-options
nosniff
date
Wed, 13 Nov 2024 15:14:29 GMT
content-type
application/javascript
last-modified
Tue, 12 Nov 2024 03:47:39 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
558e0cc4-901e-00a8-6ed6-34479f000000
cf-ray
8e1fb6387b496dcd-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
7212
x-ms-blob-type
BlockBlob
server
cloudflare
fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/
32 KB
3 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
Content-Encoding
gzip
ETag
"7ebb-565d53a1d6e40-gzip"
Age
300627
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
jD-oJXbRsNPcpN4J5z4i-WgLfjAdaTF8My8akPaE9ZBCtJgGDunbKw==
Date
Sun, 10 Nov 2024 03:44:02 GMT
Content-Type
image/svg+xml
Content-Disposition
attachment; filename="fortinet-logo-white.svg"
Vary
Accept-Encoding
Last-Modified
Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 3a60765023a93f6346539d2ca40f0b12.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
1998
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/
1 KB
3 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"4fd-60a2031eb4f40"
Age
384090
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
fKp8gSkfJUUrO2UjeU3_O8x2CWxBEaeUBl-DP3yMVoAX_F8fqGqfSQ==
Date
Sat, 09 Nov 2024 04:32:59 GMT
Content-Type
image/jpeg
Last-Modified
Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 02db209838c99b1e3d9f7e6b74ddf272.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
1277
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/
160 KB
74 KB
Script
General
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
Content-Encoding
gzip
ETag
"28100-61cff033f9240-gzip"
Age
384090
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
26NGjSnwFKRRTBxlsNb39d7dpxGsXl7RfjFADjTKdJghlF02FAryBg==
Date
Sat, 09 Nov 2024 04:32:59 GMT
Content-Type
application/javascript;charset=utf-8
Vary
Accept-Encoding
Last-Modified
Thu, 11 Jul 2024 20:57:37 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 87e6563b344d9d0eb9b5aa233652bc74.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
74768
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
f85f39fc-d7aa-467a-b762-fbb722748016.json
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/
5 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-md5
Uj3iBUKm1Vl2g2NHq67V+w==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
cf-cache-status
HIT
etag
0x8DC07DF23DF5130
age
9058
x-ms-lease-status
unlocked
x-content-type-options
nosniff
x-ms-version
2009-09-19
expires
Thu, 14 Nov 2024 15:14:29 GMT
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/json
last-modified
Thu, 28 Dec 2023 19:56:54 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin, cross-origin
x-ms-request-id
812fd0b8-001e-0025-0e4c-260b39000000
cf-ray
8e1fb6394c2a7440-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
1792
x-ms-blob-type
BlockBlob
server
cloudflare
truncated
/
71 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
fg-rat-hero.jpg
www.fortinet.com/content/dam/fortinet-blog/article-heros/
117 KB
119 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-heros/fg-rat-hero.jpg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
0cf246d6cd139b795a60b01f5d66885f3a685b2433222bd698371d429418d5ea
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"1d5a7-626349f6adec0"
Age
436361
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
DjPhxbDreK2gEK1x_vKlco8LZo7cdpr_PKQMa1NTRaca9SX6FJaVIQ==
Date
Fri, 08 Nov 2024 14:02:34 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:41:55 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 d7441270a7210a12742f2ba6f1dfb028.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
120231
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
deep-analysis-of-new-emotet-variant-part-2.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/
35 KB
36 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/deep-analysis-of-new-emotet-variant-part-2.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
9ce9e23b2f0aff01f3a20cde4e99e014e306dfb3c420bee920ea9e0f323a6ccc
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"8a6d-5673b5c033a00"
Age
372205
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
PKPOqks-UVd_B7tsJg8pDcEdPCN3Flwsnt-iz-uqEVqCcxfsWIQw0Q==
Date
Sat, 09 Nov 2024 07:51:04 GMT
Content-Type
image/png
Last-Modified
Mon, 12 Mar 2018 18:32:08 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher2uswest1-28559771
Connection
keep-alive
Via
1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
35437
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
pdf-phishing-leads-to-nanocore-rat-targets-french-nationals.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/
153 KB
154 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/pdf-phishing-leads-to-nanocore-rat-targets-french-nationals.jpg.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
5a922a2c59c77d6ae5ce67413c452540ffe00b468d240ab6928531bab15fce2b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"26320-567c8817b12c0"
Age
363587
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
-xtPL92dbR49X3dVBdMRkqCD7XVXStHksiXJpZgX-6_-CIAnqV-kWg==
Date
Sat, 09 Nov 2024 10:14:42 GMT
Content-Type
image/png
Last-Modified
Mon, 19 Mar 2018 18:55:47 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 3a60765023a93f6346539d2ca40f0b12.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
156448
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
a_deep_dive_analysis_of_fallchill_remote_admin_tool.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/
12 KB
13 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/a_deep_dive_analysis_of_fallchill_remote_admin_tool.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
910ab43f73b6073142379650feb6de6f77744c9a418754fab9e8c71b12065c10
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"3022-5663656517780"
Age
296444
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
Eydt0hHs3CEO7hkGrcTBGaiRcYCCwMp5xu-PtEzlL11jvMhAcreyFQ==
Date
Sun, 10 Nov 2024 04:53:45 GMT
Content-Type
image/png
Last-Modified
Tue, 27 Feb 2018 19:07:26 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher2uswest1-28559771
Connection
keep-alive
Via
1.1 02db209838c99b1e3d9f7e6b74ddf272.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
12322
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/
37 KB
38 KB
Font
General
Full URL
https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://www.fortinet.com
Referer
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Response headers

X-Vhost
publish
ETag
"9354-5df4fa74ff980"
Age
1093141
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
3UZ9UJSchmW3ABJWrcukJrzduTDD9raQ3nbhQ7Kh0ZOIwnuQPA1sXw==
Date
Thu, 31 Oct 2024 23:35:33 GMT
Content-Type
application/octet-stream
Last-Modified
Wed, 18 May 2022 21:08:06 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=2000000, public
X-Dispatcher
dispatcher2uswest1-28559771
Connection
keep-alive
Via
1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
37716
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
68 B
306 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
71cfd0bf781e3f393bca283fc9d44777a2036985a4ffe9abedf14909e63a8aef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
accept
application/json
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
access-control-allow-methods
GET, OPTIONS
cf-ray
8e1fb63a38e4d9c5-MIA
access-control-allow-origin
*
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/json
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
Content-Type
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.10.0/
356 KB
78 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c44f719750dd68af8862cbcfa4ab17d67bf462fa44992e5043f073af63c72984
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-md5
Bh9exWOPGIwRshWljrtlEw==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-lease-status
unlocked
cf-bgj
minify
cf-cache-status
HIT
x-ms-version
2009-09-19
age
17799
content-encoding
gzip
x-content-type-options
nosniff
cf-polished
origSize=364824
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/javascript
last-modified
Thu, 03 Dec 2020 02:43:00 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
f4887a51-a01e-00a0-1512-205cec000000
cf-ray
8e1fb63aee3a6dcd-MIA
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
fig01-remcos-rat-software-website.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1730856265174/
50 KB
51 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1730856265174/fig01-remcos-rat-software-website.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
ced16fb84941eb1582822542d082b1911b669ac0c125c3ba47d55e3521a1514c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"c888-6263460d52440"
Age
436361
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
jrO47LEnt1zo8-m_KXykg4Zkk5KKqHSJHEhkQ-gl1zfv6OvkD81puA==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:24:25 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher2uswest1-28559771
Connection
keep-alive
Via
1.1 3a60765023a93f6346539d2ca40f0b12.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
51336
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig02-remcos-phishing-email.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_2145042393.img.jpeg/1730856285752/
77 KB
78 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_2145042393.img.jpeg/1730856285752/fig02-remcos-phishing-email.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
fc0de94620ef9ccacfa68e0c7fef1dd6ad73f7920acd47cc1009713af6f1b703
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"133db-6263462065140"
Age
436361
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
BBSu4wSAnrKQtPIc3dctWyrfwbWbklLpG4fimFMbjr03NqGqvCN3yA==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:24:45 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher2uswest1-28559771
Connection
keep-alive
Via
1.1 d7441270a7210a12742f2ba6f1dfb028.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
78811
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
truncated
/
42 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/gif
fig03-remcos-excel-file.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1526230262.img.jpeg/1730856306653/
77 KB
79 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1526230262.img.jpeg/1730856306653/fig03-remcos-excel-file.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
75e1826a8d1cd5059e09ca0c508d8da3228ecf159fd01316ec34eaef57543357
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"134ca-626346346c080"
Age
436230
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
JjMghDA9CMhob7A58XpzUFB14Y79Xt3jgc2CtQdnE11T9CQtv_zjwg==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:25:06 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 87e6563b344d9d0eb9b5aa233652bc74.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
79050
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig04-remcos-crafted-ole.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_978323627.img.jpeg/1730856324452/
146 KB
147 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_978323627.img.jpeg/1730856324452/fig04-remcos-crafted-ole.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
30e3ee538441256091bfe54048cdb9883bd4509a9e6e4b68827771ddb1cf4207
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"2471c-6263464596900"
Age
436237
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
VFzWn5Lq0xaiwEW8o52Y-TcoPAd4Llvsvicq0kIJqD-HweeUD_NVwQ==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:25:24 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
149276
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig05-remcos-downloaded-hta.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_214426422.img.jpeg/1730856341252/
108 KB
110 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_214426422.img.jpeg/1730856341252/fig05-remcos-downloaded-hta.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
c5e2f3bd6de83dae9307b2eb56380edaef01582a4ca721583ce3c745b15c2388
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"1b119-62634655ccf40"
Age
436360
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
G0_Av5H_b9xAwLB6WWAqE_LWV-BtDdMwErJbNyFPYUKpzSc2v3k4PA==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:25:41 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher2uswest1-28559771
Connection
keep-alive
Via
1.1 7c52bc60e0da5f557ed6047264a41c18.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
110873
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig06-remcos-examples-script.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_215710500.img.jpeg/1730856359157/
169 KB
171 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_215710500.img.jpeg/1730856359157/fig06-remcos-examples-script.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
2bc3f32248814e53fb0792922dae3d54ebbeb6c7be7d95d20df0e2fa6a69ae67
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"2a4dd-62634666f77c0"
Age
436106
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
iDnAQnW_RKVs7lwVX3dEH2oXBqRoOL45SWcTzY3jl9ED5hjpZMOwJg==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:25:59 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 02db209838c99b1e3d9f7e6b74ddf272.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
173277
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig07-remcos-extracted-files.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1869023178.img.jpeg/1730856378002/
66 KB
67 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1869023178.img.jpeg/1730856378002/fig07-remcos-extracted-files.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
f2489dc61786cfcc0a7d81d9ef195c9ad53620928e746388f507f59f76cbb258
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"106d0-6263467916280"
Age
435942
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
OGa5u3--mr1vV-UZELWNwlFC3z7Dw4RuJVDgSR0WafsV3Pgms5nzqA==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:26:18 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 d7441270a7210a12742f2ba6f1dfb028.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
67280
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig08-remcos-dllhost-powershell.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1494152091.img.jpeg/1730856395632/
137 KB
138 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1494152091.img.jpeg/1730856395632/fig08-remcos-dllhost-powershell.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
3cafe408bf18e918d7daac870762a97244d03a73aca8ed7fe6a17141dfe34dad
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"22255-626346894c8c0"
Age
436237
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
8CAphTTbhDjWsc8N76sCJOjJdMHTPPUjzhOCW1bASUD4krSK_YUMdw==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:26:35 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 3a60765023a93f6346539d2ca40f0b12.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
139861
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig09-remcos-debugging-aerognosy.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1263028014.img.jpeg/1730856420367/
99 KB
100 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1263028014.img.jpeg/1730856420367/fig09-remcos-debugging-aerognosy.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
5f13d75795dbc9a02d514d38afb282a463efe4698b22c820a040b17c132a6127
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"18be6-626346a124100"
Age
436237
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
_KXsqYQ0SW07RfjwnGFzbcAoR3KqLeiOKIoVeHtlWkbwhsi6wownWA==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:27:00 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 87e6563b344d9d0eb9b5aa233652bc74.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
101350
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig10-remcos-decrypted-code.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1245682691.img.jpeg/1730856441657/
106 KB
107 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1245682691.img.jpeg/1730856441657/fig10-remcos-decrypted-code.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
8cbd18186b68edee7ccf8f12acfd296f3752d51cd0ebc04dff271e9d601d744d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"1a7ad-626346b52b040"
Age
436237
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
hPahfmjojAhvvHOMIE4XEr0jqL2HZxdAg58-gIlYeZIspQZNbG3ZpA==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:27:21 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 d7441270a7210a12742f2ba6f1dfb028.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
108461
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig11-remcos-exception.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1504675537.img.jpeg/1730856457579/
91 KB
92 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1504675537.img.jpeg/1730856457579/fig11-remcos-exception.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
789e8ae2f43db57070e47d9ab0ec5ba687cd2e3525084d152b001cb17e36d03c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"16ae7-626346c46d440"
Age
436106
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
xcsKbLXsrgIjyQ-pBzZo62gWqp97epOndqkaNU3aqBLZlZ5MkIcglA==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:27:37 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 7c52bc60e0da5f557ed6047264a41c18.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
92903
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig12-remcos-zwsetinformation.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1264330218.img.jpeg/1730856485385/
91 KB
92 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1264330218.img.jpeg/1730856485385/fig12-remcos-zwsetinformation.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
b726aa772c609165b5815643b26bb2e91d5d55d337a1cd073a0b9b943d77e869
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"16c89-626346df21340"
Age
436106
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
HVwe2aV5b8AzGUZlGD_L-l14bzfShfwQreVOCsDhZle0QPwiapa6oA==
Date
Wed, 13 Nov 2024 15:01:28 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:28:05 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
93321
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig12a-remcos.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1026353546.img.jpeg/1730856721310/
37 KB
38 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1026353546.img.jpeg/1730856721310/fig12a-remcos.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
259bd74127f3150b5dbe1c2f9da49d1dbeeecce06bd0152f333839f448722ae2
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"92e0-626347c032640"
Age
435940
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
0Ln5IrCPNj5Ol6OEzpq9RfL_FdjgBeHsaF-AOC31VvTzpoX_vCoyIg==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:32:01 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 3a60765023a93f6346539d2ca40f0b12.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
37600
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig12b-remcos.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_2010556436.img.jpeg/1730856715090/
52 KB
53 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_2010556436.img.jpeg/1730856715090/fig12b-remcos.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
c3b557d8a9405227edbfd04c2f2f199168deceb2806059a02abba860054615a5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"cfaf-626347ba798c0"
Age
436237
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
RE8sXHOEuEQuHl56zxaA-NbArtb6hFYcJ7YCNYkLZPIFur-kKBL4Bg==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:31:55 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 87e6563b344d9d0eb9b5aa233652bc74.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
53167
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig13-remcos-display.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_759706181.img.jpeg/1730856571640/
132 KB
133 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_759706181.img.jpeg/1730856571640/fig13-remcos-display.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
3923bff4786ef686d8dd4376b99c73c72b93e302b1dfb68243c7b620c4c27b99
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"20f13-62634731254c0"
Age
436230
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
uj2tW5NagJ-2cAHb0Bny1qJDY9tenr_r_hTgiu5TmPjSicq6w1Q8gA==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:29:31 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 02db209838c99b1e3d9f7e6b74ddf272.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
134931
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig14-remcos-autorun.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_116464583.img.jpeg/1730856593234/
193 KB
194 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_116464583.img.jpeg/1730856593234/fig14-remcos-autorun.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
a1050b6624dd64bb43f5b8c093c1363ab2fdc3b0698ee486df2e7d897d2c6ef6
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"302f9-6263474620640"
Age
436237
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
eOs-Gqy0VEDHAaj4sOLzrUmrC2SU9STvKQPIg0bk5Jbl51AQRuAhJg==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:29:53 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 7c52bc60e0da5f557ed6047264a41c18.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
197369
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig15-remcos-payload.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1244753560.img.jpeg/1730856614418/
94 KB
96 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1244753560.img.jpeg/1730856614418/fig15-remcos-payload.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
38a4d98e8a644d2a59d5f709452915bec15b125de944590af7fcaeb06b2472ca
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"17920-6263475a27580"
Age
436229
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
xwu_cQKBCzApXkCxd25BQnfnZjn3CK0siuEv4PKQMNzrO8rtZ2-a4g==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:30:14 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 d7441270a7210a12742f2ba6f1dfb028.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
96544
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig16-remcos-memory-view-decrypted-setting-blocl.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_116539316.img.jpeg/1730856630902/
209 KB
211 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_116539316.img.jpeg/1730856630902/fig16-remcos-memory-view-decrypted-setting-blocl.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
7d8bd939933062935977eeb7af4d11047164be70e17407be8c754458ae19ba4e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"34522-6263476969980"
Age
436236
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
ygdiH4Xto1J6L7mv67kqLVqLoM5ApEjSHBYZAWVKq08uIW7Luwl22w==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:30:30 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
214306
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig17-remcos-register-packet.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_320814119.img.jpeg/1730856652374/
266 KB
268 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_320814119.img.jpeg/1730856652374/fig17-remcos-register-packet.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
4874fa9fd13dc1a03d79114835648fcad2a4ea5f9e53a72a19f7a1c2f002de34
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"428a2-6263477e64b00"
Age
436237
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
UaJdw7mkSLxlDHt1bcWYOJuHaGj6nrqISz7orN9m43QzbezusiKwIg==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:30:52 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 3a60765023a93f6346539d2ca40f0b12.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
272546
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig17b-remcos-command.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1144901365.img.jpeg/1730856733204/
8 KB
9 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1144901365.img.jpeg/1730856733204/fig17b-remcos-command.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
32b4931413d5ce2afcf4ef52b12d39c3d6dd7247bd73c3a160c734b67c1a4c95
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"1f26-626347cba4140"
Age
436231
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
1o0lik7wdSlxcZqqkDzXNSY12aABmVqeCssTL0zR-yIoHT1F5hoe3Q==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:32:13 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 87e6563b344d9d0eb9b5aa233652bc74.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
7974
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig18-remcos-send-process-list-c2.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_42816202.img.jpeg/1730856755219/
219 KB
220 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_42816202.img.jpeg/1730856755219/fig18-remcos-send-process-list-c2.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
d12d6916f244b407ef03c8a770d16da6a3aa60adef4d3ad50c6341c32fe841cc
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"36ad6-626347e09f2c0"
Age
436105
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
osaT5M1pSc_zgroayFm1lvu42CWEXhMiCHSrhVaUn5d3Zeez23PI2A==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:32:35 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 02db209838c99b1e3d9f7e6b74ddf272.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
223958
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig19-remcos-process-manager.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1820712132.img.jpeg/1730856776798/
122 KB
124 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_1820712132.img.jpeg/1730856776798/fig19-remcos-process-manager.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
a5fedaddf8960351b7dcb1bf9b4a2ce58b28a336901d7eebe92b92c9aeb185f8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"1e978-626347f4a6200"
Age
436236
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
yvs19J8tUtzIx412ptGDcsT49q4052tBVf2PdBo9fu7sn-0jacSNjQ==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:32:56 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 d7441270a7210a12742f2ba6f1dfb028.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
125304
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig19-remcos-table.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_988305437.img.jpeg/1730856801764/
577 KB
578 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_988305437.img.jpeg/1730856801764/fig19-remcos-table.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
23ca5578686d651deed4508b104fe16de675ab296becda560dc17d741f090af1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"9046c-6263480c7da40"
Age
436236
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
9vJGviUjhZtOlcaZsdu-vljbNnrAn-0zKf0PX_qE4gEHoErwG3I7pQ==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:33:21 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 87e6563b344d9d0eb9b5aa233652bc74.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
590956
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
fig20-remcos-workflow.jpeg
www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_109718400.img.jpeg/1730856820846/
69 KB
71 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims/_jcr_content/root/responsivegrid/table_content/par/image_109718400.img.jpeg/1730856820846/fig20-remcos-workflow.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
c93c62ebfd2a7f0e95f77ea558c53c2536ba327c1a28ad4870f2d518476500b6
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
ETag
"115f2-6263481e9c500"
Age
436230
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
QhqWeFE0CR_e7AS5HiZuGpSUJ1RFyGEUYiNxuhrHIikmGRBi1hnBDw==
Date
Wed, 13 Nov 2024 15:01:29 GMT
Content-Type
image/jpeg
Last-Modified
Wed, 06 Nov 2024 01:33:40 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=684000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
71154
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
en.json
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/
99 KB
24 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-md5
SDJFQYswktbx6w5cJzzMRQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
cf-cache-status
HIT
etag
0x8DC07DF2B6F9C71
age
69702
x-ms-lease-status
unlocked
x-content-type-options
nosniff
x-ms-version
2009-09-19
expires
Thu, 14 Nov 2024 15:14:30 GMT
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/json
last-modified
Thu, 28 Dec 2023 19:57:06 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin, cross-origin
x-ms-request-id
6c547f26-001e-002e-324c-26134d000000
cf-ray
8e1fb63bc81c7440-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
24004
x-ms-blob-type
BlockBlob
server
cloudflare
otFlat.json
cdn.cookielaw.org/scripttemplates/6.10.0/assets/
13 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-md5
W9e0YobmEbvdB0V9OmpQkw==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8D89735209A34D6
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
51205
x-content-type-options
nosniff
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/json
last-modified
Thu, 03 Dec 2020 02:42:50 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
9d92755c-601e-00d0-506b-cd2f28000000
cf-ray
8e1fb63c49177440-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
3329
x-ms-blob-type
BlockBlob
server
cloudflare
otPcTab.json
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/
45 KB
12 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-md5
zNsRoM1FEmsEgJoYMCNTng==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8D897352245C4EA
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
66702
x-content-type-options
nosniff
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/json
last-modified
Thu, 03 Dec 2020 02:42:53 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
77f313b5-301e-0034-7eb4-210a4b000000
cf-ray
8e1fb63c491a7440-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
11755
x-ms-blob-type
BlockBlob
server
cloudflare
launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
assets.adobedtm.com/
506 KB
122 KB
Script
General
Full URL
https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
0cd344605a83e699d26efaf3206c882e108d1197292e2f3b4c327a24ed53e613
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"5af35dc6c4eab0ab0109cd04e32f1d39:1730940560.67827"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:30 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
124401
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:20 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
id
dpm.demdex.net/
367 B
914 B
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1731510870552
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.197.160.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-160-137.compute-1.amazonaws.com
Software
/
Resource Hash
96bd6c16407e51bc964ec45a12633389a3c3b599f225874a86e7cea398526681
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-va6-2-v068-06ab925cd.edge-va6.demdex.com 7 ms
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
x-tid
ikGMTd2iRrU=
expires
Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin
https://www.fortinet.com
content-length
309
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/json;charset=utf-8
vary
Origin
dest5.html
fortinet.demdex.net/ Frame 3BB2
0
0
Document
General
Full URL
https://fortinet.demdex.net/dest5.html?d_nsid=0
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.146.68.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-68-25.compute-1.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.fortinet.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding
gzip
content-type
text/html;charset=UTF-8
date
Wed, 13 Nov 2024 15:14:30 GMT
dcs
dcs-prod-va6-2-v068-0f72c803b.edge-va6.demdex.com 0 ms
expires
Thu, 01 Jan 1970 00:00:00 UTC
last-modified
Mon, 11 Nov 2024 10:48:48 GMT
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains
vary
accept-encoding
x-tid
8+nq0A9nQOc=
ibs:dpid=411&dpuuid=ZzTCVgAAAMGZugN2
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=63294759403938320303313056908800215410
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZzTCVgAAAMGZugN2
42 B
716 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZzTCVgAAAMGZugN2
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Server
34.197.160.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-160-137.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-va6-2-v068-0721fc168.edge-va6.demdex.com 11 ms
content-encoding
gzip
pragma
no-cache
x-content-type-options
nosniff
x-tid
zG2LlcKWQ+s=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
59
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
image/gif

Redirect headers

Cache-Control
no-cache
Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZzTCVgAAAMGZugN2
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length
0
Date
Wed, 13 Nov 2024 15:14:30 GMT
Connection
keep-alive
Server
AMO-cookiemap/1.1
delivery
fortinet.tt.omtrdc.net/rest/v1/
351 B
832 B
XHR
General
Full URL
https://fortinet.tt.omtrdc.net/rest/v1/delivery?client=fortinet&sessionId=af0b4cb3d4d04cbdaab59c3d5af48858&version=2.10.0
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.140.39.240 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ip-63-140-39-240.data.adobedc.net
Software
jag /
Resource Hash
f90a12e53778185041a29bc37dbdd7d808eda0ac304d0822ba7ede32fd2646c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-request-id
c59d11a5-0b46-41ba-b741-55ed9ead7c45
cache-control
no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin
*
content-encoding
gzip
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials
true
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
access-control-allow-origin
https://www.fortinet.com
date
Wed, 13 Nov 2024 15:14:30 GMT
x-xss-protection
1; mode=block
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
server
jag
AppMeasurement.min.js
assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/
35 KB
13 KB
Script
General
Full URL
https://assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/AppMeasurement.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
7db8d077fc21c20f1449a2603d524e423cfa25d7df6d5fd845a8e5e883aa227e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-cache
timing-allow-origin
*
content-encoding
gzip
etag
"66aabcd8a7ba429711eebdad8acc3dd6:1729811534.672229"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:30 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
13011
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/x-javascript
last-modified
Thu, 24 Oct 2024 23:12:14 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
AppMeasurement_Module_ActivityMap.min.js
assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/
3 KB
2 KB
Script
General
Full URL
https://assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/AppMeasurement_Module_ActivityMap.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
2a250e2f225e48cf583d54a0a42d623c700847de17323bf23ea372e5d9e89cb2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-cache
timing-allow-origin
*
content-encoding
gzip
etag
"ddda3fb3f27121fcba6a33a82f32d57c:1729811534.987187"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:30 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
1598
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/x-javascript
last-modified
Thu, 24 Oct 2024 23:12:14 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
0786.js
script.crazyegg.com/pages/scripts/0117/
7 KB
3 KB
Script
General
Full URL
https://script.crazyegg.com/pages/scripts/0117/0786.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16fb72ffe51980a00e52edf9a001b7d560b2bdbd1a56e04366a70b674204c359

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-expose-headers
CE-Version
content-encoding
gzip
cf-cache-status
HIT
age
94340
alt-svc
h3=":443"; ma=86400
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
text/javascript
last-modified
Tue, 12 Nov 2024 13:02:11 GMT
vary
Accept-Encoding
cache-control
public, max-age=300, s-maxage=1209600
timing-allow-origin
*
cf-ray
8e1fb63fed519ae0-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
2481
ce-version
11.5.306
server
cloudflare
6si.min.js
j.6sc.co/
68 KB
19 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
private, proxy-revalidate, max-age=10800
content-encoding
gzip
etag
"66fb91ae-111bb"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 18:14:31 GMT
accept-ranges
bytes
content-length
18819
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
application/javascript
vary
Accept-Encoding
server
nginx/1.14.0 (Ubuntu)
last-modified
Tue, 01 Oct 2024 06:07:42 GMT
obtp.js
amplify.outbrain.com/cp/
30 KB
10 KB
Script
General
Full URL
https://amplify.outbrain.com/cp/obtp.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.199.37.208 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-199-37-208.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
da7fd15533dece70af68accd0eae75fc46e3ee044da41bdef69215d375af95c5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Cache-Control
max-age=1200
Content-Encoding
gzip
ETag
"a5f728b2b15c692a274e233ef348d0fd:1730623228.037657"
Connection
keep-alive
Expires
Wed, 13 Nov 2024 15:34:31 GMT
Accept-Ranges
bytes
X-CC
US
Content-Length
9305
X-RG
NA
Date
Wed, 13 Nov 2024 15:14:31 GMT
Content-Type
application/x-javascript
Last-Modified
Sun, 03 Nov 2024 08:37:25 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
25f2dd15-02c6-4e7a-bc8b-c5722b49624d
tag.simpli.fi/sifitag/
3 KB
2 KB
Script
General
Full URL
https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.245.15.98 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
98.15.245.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

x-request-id
GAeP9p-6jrN7SE7Hy4mC
cache-control
max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding
gzip
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
server
openresty
bat.js
bat.bing.com/
50 KB
15 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
content-encoding
gzip
etag
"028e0691d20db1:0"
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 229D3357A03448AAA0EDF48A97C660D4 Ref B: MIAEDGE1717 Ref C: 2024-11-13T15:14:31Z
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
14579
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/javascript
last-modified
Wed, 16 Oct 2024 22:47:44 GMT
vary
Accept-Encoding
RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
9 KB
2 KB
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
b5434794dd48d15d9e0a31e0d6b9b64afb739c5835bd1972e84096d1e35f4ed1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:31 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
1844
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
358 B
509 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
7c502d550f5fe20eee417decbabf97452005f80d5ffe8933e2b0fe8cbcf33fe9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:31 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
229
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
703 B
708 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
0e558bfe20ca32463b1b3ba7fc2e06dac3850e7f816c5071599d3c150eeb65f1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:31 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
427
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
www.fortinet.com.json
script.crazyegg.com/pages/data-scripts/0117/0786/site/
5 KB
2 KB
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b3b9f816048eba794278ecb39ff263ac3b7bc55c235b1c6c891c42b11f8435b8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-expose-headers
CE-Version
content-encoding
gzip
cf-cache-status
HIT
age
94340
alt-svc
h3=":443"; ma=86400
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
application/json
last-modified
Tue, 12 Nov 2024 13:02:11 GMT
vary
Accept-Encoding
cache-control
public, max-age=300, s-maxage=1209600
timing-allow-origin
*
cf-ray
8e1fb6409e6b498a-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
1568
ce-version
11.5.306
server
cloudflare
17532650.js
bat.bing.com/p/action/
363 B
422 B
Script
General
Full URL
https://bat.bing.com/p/action/17532650.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4922a8859b315c354c23ad278e35483c6cf29aebf1c509c2c928c1f41634fe43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
content-encoding
br
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 65FF374AC9CB4F5E967DEEFE94E7ADF6 Ref B: MIAEDGE1717 Ref C: 2024-11-13T15:14:31Z
x-cache
CONFIG_NOCACHE
date
Wed, 13 Nov 2024 15:14:30 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
c145caf9bd0f62535e3720b5d68c2190.js
script.crazyegg.com/pages/versioned/common-scripts/
105 KB
36 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/common-scripts/c145caf9bd0f62535e3720b5d68c2190.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bfb50654266cd61ddc1f60811a6f517eddab6abeca093e5369fe0e61dacd32f3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
public, max-age=31536000, s-maxage=31536000
timing-allow-origin
*
content-encoding
gzip
cf-cache-status
HIT
age
94350
cf-ray
8e1fb640ff379ae0-MIA
accept-ranges
bytes
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
36518
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
text/javascript
last-modified
Mon, 21 Oct 2024 19:09:58 GMT
vary
Accept-Encoding
server
cloudflare
js
www.googletagmanager.com/gtag/
322 KB
107 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2008 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d4a80838b8edb9ed18d58be8bed24eba466c1d004b4178a47b661c61093a34df
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Wed, 13 Nov 2024 15:14:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
109345
x-xss-protection
0
server
Google Tag Manager
00ad3119690e692fd6990245f9741ea8f1
wave.outbrain.com/mtWavesBundler/handler/
2 B
515 B
Script
General
Full URL
https://wave.outbrain.com/mtWavesBundler/handler/00ad3119690e692fd6990245f9741ea8f1
Requested by
Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.51.57.192 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-51-57-192.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
Cache-Control
max-age=60
ob-sent-time
1731493196862
Content-Encoding
gzip
ETag
W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection
keep-alive
Expires
Wed, 13 Nov 2024 15:15:31 GMT
Access-Control-Allow-Origin
*
X-CC
US
Content-Length
22
X-RG
NA
Date
Wed, 13 Nov 2024 15:14:31 GMT
Content-Type
text/html; charset=utf-8
Vary
Accept-Encoding
x-traceid
d0f6e3794fdb61f46f98b9556ef685e
topics
amplify.outbrain.com/
26 B
301 B
Fetch
General
Full URL
https://amplify.outbrain.com/topics
Requested by
Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.199.37.208 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-199-37-208.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Cache-Control
max-age=1200
Connection
keep-alive
Observe-Browsing-Topics
?1
Expires
Wed, 13 Nov 2024 15:34:31 GMT
Access-Control-Allow-Origin
*
X-CC
US
Content-Length
26
X-RG
NA
Date
Wed, 13 Nov 2024 15:14:31 GMT
Content-Type
text/html
unifiedPixel
tr.outbrain.com/
53 B
321 B
Fetch
General
Full URL
https://tr.outbrain.com/unifiedPixel?au=false&bust=012205985651106332&referrer=&cht=ot&marketerId=00ad3119690e692fd6990245f9741ea8f1&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&g=0&zone=all&obApiVersion=1.1&obtpVersion=2.0.5
Requested by
Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
64.202.112.159 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache
content-length
54
content-encoding
br
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
image/gif;
x-traceid
d437f7d9dc92eb569aeb8169fa06b1b0
cachedClickId
tr.outbrain.com/
35 B
293 B
Script
General
Full URL
https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1
Requested by
Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
64.202.112.159 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
39
content-encoding
br
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
application/javascript
x-traceid
979f348593699a0bbc8a27440a9cd8f6
0
bat.bing.com/action/
0
359 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=755c34e7-96b6-4a2d-9d68-9805227b22e2&bo=1&sid=fb8c1a90a1d111efb26f8d2ecfe328db&vid=fb8c4db0a1d111efbd18adc039b12f14&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&kw=FortiGuard%20Labs%20Threat%20Research,rat&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&r=&lt=1132&pt=1731510869096,,,,,1,2,99,99,219,157,219,635,693,643,1122,1122,1132,,,&pn=0,0&evt=pageLoad&sv=1&cdb=AQET&rn=570853
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, must-revalidate
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: A34934AB43FE4E6392C229C7E5473722 Ref B: MIAEDGE1717 Ref C: 2024-11-13T15:14:31Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Wed, 13 Nov 2024 15:14:30 GMT
/
c.6sc.co/
7 B
194 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-max-age
86400
access-control-allow-credentials
true
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.fortinet.com
content-length
7
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
text/html
access-control-allow-headers
*
/
ipv6.6sc.co/
19 B
310 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2e::17d1:48d1 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
a48d321e1f30c017b6d9407b160c7253ee3dee7e1b28c9f49e57e40c52b4a71e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
pragma
no-cache
6si-ipv6
2001:550:1d05:1::13
expires
Wed, 13 Nov 2024 15:14:31 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1731510871386_399550033_886550150_18_644_63_118_219";dur=1
access-control-allow-origin
https://www.fortinet.com
content-length
19
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
text/html
vary
Origin
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=30ffca77-8036-428a-8088-af95c12fe50d&session=acfab952-1775-4d90-874f-268f5cf0e5c6&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A31%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22See%20how%20threat%20actors%20have%20abused%20Remcos%20to%20collect%20sensitive%20information%20from%20victims%20and%20remotely%20control%20their%20computers%20to%20perform%20further%20malicious%20acts.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Crat%22%2C%22title%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pageViewId=8b4f0ce7-6864-4bf1-8a01-a83317d35573&v=1.1.29
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"5e502810-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 15:14:31 GMT
accept-ranges
bytes
content-length
43
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
image/gif
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=30ffca77-8036-428a-8088-af95c12fe50d&session=acfab952-1775-4d90-874f-268f5cf0e5c6&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2013%20Nov%202024%2015%3A14%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%225eeecf22b2d12a77a14639dce97b7a36%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2013%20Nov%202024%2015%3A14%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2013%20Nov%202024%2015%3A14%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2013%20Nov%202024%2015%3A14%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227381d1d7c753fe2d8e217c3fdc44c0f17418dcc4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2013%20Nov%202024%2015%3A14%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22See%20how%20threat%20actors%20have%20abused%20Remcos%20to%20collect%20sensitive%20information%20from%20victims%20and%20remotely%20control%20their%20computers%20to%20perform%20further%20malicious%20acts.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Crat%22%2C%22title%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pageViewId=8b4f0ce7-6864-4bf1-8a01-a83317d35573&v=1.1.29
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"63f020a0-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 15:14:31 GMT
accept-ranges
bytes
content-length
43
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
image/gif
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
www.fortinet.com.json
script.crazyegg.com/pages/data-scripts/0117/0786/sampling/
46 B
278 B
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0117/0786/sampling/www.fortinet.com.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/c145caf9bd0f62535e3720b5d68c2190.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a2816206ea0d9b29d21a55ff5a266058db372a3f87696a6a463bdc85cb1a949

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-expose-headers
CE-Version
content-encoding
gzip
cf-cache-status
HIT
age
94340
alt-svc
h3=":443"; ma=86400
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
application/json
last-modified
Tue, 12 Nov 2024 13:02:11 GMT
vary
Accept-Encoding
cache-control
public, max-age=300, s-maxage=1209600
timing-allow-origin
*
cf-ray
8e1fb641d80d498a-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
65
ce-version
11.5.306
server
cloudflare
clock
tracking.crazyegg.com/
39 B
145 B
XHR
General
Full URL
https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1731510871380&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/c145caf9bd0f62535e3720b5d68c2190.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.136.49 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-136-49.us-east-2.compute.amazonaws.com
Software
awselb/2.0 /
Resource Hash
30cdd063281864e41a8e076752bc1ea6e6534d7e7f3b35433a6ac3bf4982ebe4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type
application/json
Referer
https://www.fortinet.com/

Response headers

cache-control
no-store
access-control-allow-origin
*
content-length
39
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
text/plain
server
awselb/2.0
details
eps.6sc.co/v3/company/
752 B
660 B
XHR
General
Full URL
https://eps.6sc.co/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afe865822f884bb48.awsglobalaccelerator.com
Software
/
Resource Hash
55096bdb72819db90b109af46d94fce8e71551e9c7a8464a6dcf930f60bb7f39

Request headers

Authorization
Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID
WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-expose-headers
X-6si-Region
timing-allow-origin
https://6sense.com
content-encoding
gzip
x-6si-region
access-control-allow-credentials
true
access-control-allow-origin
https://www.fortinet.com
content-length
400
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
application/json
vary
Origin, Accept-Encoding
clock
tracking.crazyegg.com/ Frame
0
0
Preflight
General
Full URL
https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1731510871380&tk=329ee1373036c5ddcda74cf257baa0a6
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.136.49 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-136-49.us-east-2.compute.amazonaws.com
Software
awselb/2.0 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.fortinet.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods
access-control-allow-methods
*
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public, max-age=86400
date
Wed, 13 Nov 2024 15:14:31 GMT
server
awselb/2.0
vary
Access-Control-Request-Headers, Origin, Access-Control-Request-Method
details
eps.6sc.co/v3/company/ Frame
0
0
Preflight
General
Full URL
https://eps.6sc.co/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afe865822f884bb48.awsglobalaccelerator.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://www.fortinet.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.fortinet.com
access-control-expose-headers
X-6si-Region
access-control-max-age
1800
content-length
0
date
Wed, 13 Nov 2024 15:14:31 GMT
timing-allow-origin
https://6sense.com
x-6si-region
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=30ffca77-8036-428a-8088-af95c12fe50d&session=acfab952-1775-4d90-874f-268f5cf0e5c6&event=ipv6&q=%7B%22address%22%3A%222001%3A550%3A1d05%3A1%3A%3A13%22%7D&isIframe=false&m=%7B%22description%22%3A%22See%20how%20threat%20actors%20have%20abused%20Remcos%20to%20collect%20sensitive%20information%20from%20victims%20and%20remotely%20control%20their%20computers%20to%20perform%20further%20malicious%20acts.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Crat%22%2C%22title%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pageViewId=8b4f0ce7-6864-4bf1-8a01-a83317d35573&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.29
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"60bb2e15-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 15:14:31 GMT
accept-ranges
bytes
content-length
43
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
image/gif
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
api.min.js
a.opmnstr.com/app/js/
47 KB
17 KB
Script
General
Full URL
https://a.opmnstr.com/app/js/api.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-NY1-885 /
Resource Hash
7c766428dac46814e1fec869d324282ea07cfe306868967aa8a372a3616ed4ed

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

perma-cache
HIT
cdn-status
200
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding
br
etag
"672cd5de-bb7b"
cdn-fileserver
622
date
Wed, 13 Nov 2024 15:14:31 GMT
cdn-storageserver
NY-427
last-modified
Thu, 07 Nov 2024 14:59:42 GMT
content-type
application/javascript
vary
Accept-Encoding
cdn-cache
HIT
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode
200
cdn-cachedat
11/10/2024 02:23:44
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
cdn-requesttime
0
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid
ac42d2f755a6db7223b33df5e8f0c176
cdn-pullzone
293267
cdn-proxyver
1.06
access-control-allow-origin
*
cdn-edgestorageid
885
server
BunnyCDN-NY1-885
cdn-requestcountrycode
US
collect
www.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-38BQ9XFDT4&gtm=45je4b70v9191763579za200&_p=1731510871613&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101823848~101925629~102077854&cid=212376315.1731510872&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1731510871&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&dt=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2553
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.fortinet.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 13 Nov 2024 15:14:31 GMT
content-type
text/plain
server
Golfe2
s58429240468173
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/
43 B
372 B
Image
General
Full URL
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/s58429240468173?AQB=1&ndh=1&pf=1&t=13%2F10%2F2024%205%3A14%3A31%203%20600&sdid=7650CD1BCF706C4E-74CCAA3796528440&mid=62917956448380804703277624010444302586&aamlh=7&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Anew-campaign-uses-remcos-rat-to-exploit-victims&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&c7=Entire%20Site&c8=New&v25=62917956448380804703277624010444302586&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Anew-campaign-uses-remcos-rat-to-exploit-victims&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&v106=Miami&v107=Florida&v108=United%20States&v126=NA&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.140.38.112 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ip-63-140-38-112.data.adobedc.net
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache, no-store, max-age=0, no-transform, private
pragma
no-cache
etag
3718391285464924160-4618573988680219267
x-content-type-options
nosniff
expires
Tue, 12 Nov 2024 15:14:32 GMT
access-control-allow-origin
*
p3p
CP="This is not a P3P policy"
content-length
43
date
Wed, 13 Nov 2024 15:14:32 GMT
x-xss-protection
1; mode=block
last-modified
Thu, 14 Nov 2024 15:14:32 GMT
vary
*
server
jag
content-type
image/gif;charset=utf-8
api.min.css
a.omappapi.com/app/js/
10 KB
3 KB
Stylesheet
General
Full URL
https://a.omappapi.com/app/js/api.min.css
Requested by
Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-NY1-885 /
Resource Hash
d491f197645c391fa5f44c565d359352a3b1e714e8cb0c2e71ed0a21588d45bd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

perma-cache
HIT
cdn-status
200
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding
br
etag
"672cd234-2644"
cdn-fileserver
749
date
Wed, 13 Nov 2024 15:14:32 GMT
cdn-storageserver
NY-427
last-modified
Thu, 07 Nov 2024 14:44:04 GMT
content-type
text/css
vary
Accept-Encoding
cdn-cache
HIT
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode
200
cdn-cachedat
11/13/2024 15:14:13
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
cdn-requesttime
0
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid
0f03ffac23e3879e8e44691d59a6a78d
cdn-pullzone
293267
cdn-proxyver
1.06
access-control-allow-origin
*
cdn-edgestorageid
885
server
BunnyCDN-NY1-885
cdn-requestcountrycode
US
39852
api.omappapi.com/v2/embed/
165 B
592 B
XHR
General
Full URL
https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by
Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3108::ac42:2af8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

x-user-agent
standard--
cf-cache-status
DYNAMIC
expires
Wed, 13 Nov 2024 15:15:05 GMT
x-cache
Error from cloudfront
x-amz-cf-id
lL3nbwiLy-w21AIDniDfoBGMhTTZZnFCgHhLHn5GDPeQVbbLHTA2Kg==
date
Wed, 13 Nov 2024 15:14:32 GMT
x-cache-config
0 0
content-type
application/json
vary
Accept-Encoding, User-Agent
access-control-allow-headers
X-CSRF-Token
cache-control
public, max-age=120, stale-while-revalidate=1800
via
1.1 b3022b7a8efd08934ce14d0556eaed52.cloudfront.net (CloudFront)
cf-ray
8e1fb6463d32748f-MIA
access-control-allow-origin
*
content-length
165
x-amz-cf-pop
MIA3-P7
server
cloudflare
tracking.js
trk.techtarget.com/
3 KB
2 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1347 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=0; includeSubDomains; preload
cache-control
public, max-age=1200
content-encoding
br
cf-cache-status
HIT
age
23516
via
1.1 google
cf-ray
8e1fb6464b7c21d9-MIA
expires
Wed, 13 Nov 2024 15:34:32 GMT
date
Wed, 13 Nov 2024 15:14:32 GMT
content-type
text/javascript
last-modified
Tue, 13 Dec 2022 15:01:39 GMT
vary
Accept-Encoding
server
cloudflare
tag.js
abm-tracking.demandscience.com/
2 KB
2 KB
Script
General
Full URL
https://abm-tracking.demandscience.com/tag.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) / Express
Resource Hash
1885fa140df271c97bf904d43f5385b84aa7458ff60cc20dae89ca4e9df959d9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Cache-Control
public, max-age=0
ETag
W/"879-19321dea034"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2169
Date
Wed, 13 Nov 2024 15:14:32 GMT
Content-Type
application/javascript; charset=UTF-8
X-Powered-By
Express
Server
nginx/1.18.0 (Ubuntu)
Last-Modified
Tue, 12 Nov 2024 19:34:18 GMT
wid.tracker.js
tmp.argusplatform.com/js/
8 KB
3 KB
Script
General
Full URL
https://tmp.argusplatform.com/js/wid.tracker.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preloadmax-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preloadmax-age=31536000
cache-control
public, must-revalidate, max-age=30
x-dns-prefetch-control
off
content-encoding
br
etag
"28476869"
referrer-policy
same-origin
x-content-type-options
nosniff
x-cache
CONFIG_NOCACHE
date
Wed, 13 Nov 2024 15:14:33 GMT
x-xss-protection
1; mode=block
content-type
text/javascript
last-modified
Sat, 08 Jun 2024 11:51:22 GMT
vary
Accept-Encoding
x-azure-ref
20241113T151433Z-16b74445767cshkwhC1BN1eatw0000000dyg00000000bsfd
js
pixel.mathtag.com/event/
161 B
712 B
Script
General
Full URL
https://pixel.mathtag.com/event/js?mt_id=1629896&mt_adid=260855&mt_exem=&mt_excl=&v2=&v3=&s1=&s2=&s3=&v1=en:blog:threat-research:new-campaign-uses-remcos-rat-to-exploit-victims
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.200.232.253 Frederick, United States, ASN30419 (PAEDAE-INC, US),
Reverse DNS
Software
MT3 1668 f41eadd master ord ord-pixel-x54 config_version:"3358" /
Resource Hash
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
Security Headers
Name Value
Strict-Transport-Security 31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Strict-Transport-Security
31536000
Cache-Control
no-cache
Content-Encoding
gzip
Connection
close
Cross-Origin-Resource-Policy
cross-origin
Referrer-Policy
strict-origin
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
all
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date
Wed, 13 Nov 2024 15:14:32 GMT
X-XSS-Protection
0
Content-Type
text/javascript
Server
MT3 1668 f41eadd master ord ord-pixel-x54 config_version:"3358"
gif.gif
ibc-flow.techtarget.com/a/
43 B
441 B
XHR
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1731510872109&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&version=2.4
Requested by
Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
ibc_rate_tier
1247773
Referer
https://www.fortinet.com/

Response headers

x-goog-metageneration
1
x-goog-hash
crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag
"fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods
GET, POST, OPTIONS
x-goog-stored-content-encoding
identity
expires
Wed, 13 Nov 2024 16:14:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
43
date
Wed, 13 Nov 2024 15:14:32 GMT
content-type
image/gif
last-modified
Thu, 08 Dec 2022 21:19:29 GMT
vary
Origin
x-guploader-uploadid
AHmUCY3JDQlC6PubDWN8eXrLmrMwotPTFeps8Q1mjAyxpNfCLtity0bglcezkCNFQ9ZCYgkVtx8
access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control
public, max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1670534369365034
content-length
43
server
nginx/1.20.2
gif.gif
ibc-flow.techtarget.com/a/ Frame
0
0
Preflight
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1731510872109&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&version=2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
ibc_rate_tier
Access-Control-Request-Method
GET
Origin
https://www.fortinet.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Wed, 13 Nov 2024 15:14:32 GMT
expires
Wed, 13 Nov 2024 15:14:32 GMT
server
nginx/1.20.2
vary
Origin
via
1.1 google
x-guploader-uploadid
AHmUCY2qAaRr9WEpv0ggDVJ2eIfkIMhdyzhZFRmIIC_nC8QjAfnZdg2R1azolga9Xp_tFv_qKls
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=30ffca77-8036-428a-8088-af95c12fe50d&session=acfab952-1775-4d90-874f-268f5cf0e5c6&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A32%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A31%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%221006%22%7D&isIframe=false&m=%7B%22description%22%3A%22See%20how%20threat%20actors%20have%20abused%20Remcos%20to%20collect%20sensitive%20information%20from%20victims%20and%20remotely%20control%20their%20computers%20to%20perform%20further%20malicious%20acts.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Crat%22%2C%22title%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pageViewId=8b4f0ce7-6864-4bf1-8a01-a83317d35573&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.29
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"63f02dad-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 15:14:32 GMT
accept-ranges
bytes
content-length
43
date
Wed, 13 Nov 2024 15:14:32 GMT
content-type
image/gif
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
fp.min.js
cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/
33 KB
14 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js
Requested by
Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY"
age
42033
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Wed, 13 Nov 2024 15:14:32 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-fra-etou8220049-FRA, cache-mia-kmia1760099-MIA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=604800, s-maxage=43200
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
13749
x-jsd-version
3.4.2
site-visitors
intentstream.contanuity.com/api/
115 B
374 B
Fetch
General
Full URL
https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712
Requested by
Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-226-187-177.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubdomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
x-pixel-auth
true
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=15724800; includeSubdomains
access-control-expose-headers
WWW-Authenticate,Server-Authorization
cache-control
no-cache
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
115
date
Wed, 13 Nov 2024 15:14:32 GMT
content-type
application/json; charset=utf-8
vary
origin
server
nginx
site-visitors
intentstream.contanuity.com/api/ Frame
0
0
Preflight
General
Full URL
https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-226-187-177.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubdomains

Request headers

Accept
*/*
Access-Control-Request-Headers
x-pixel-auth
Access-Control-Request-Method
GET
Origin
https://www.fortinet.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Accept,Authorization,Content-Type,If-None-Match,x-pixel-auth
access-control-allow-methods
GET
access-control-allow-origin
https://www.fortinet.com
access-control-expose-headers
WWW-Authenticate,Server-Authorization
access-control-max-age
86400
cache-control
no-cache
content-length
0
date
Wed, 13 Nov 2024 15:14:32 GMT
server
nginx
strict-transport-security
max-age=15724800; includeSubdomains
e695d42b-da79-4aea-a431-9c26a090cea3
https://www.fortinet.com/
43 B
0
Image
General
Full URL
blob:https://www.fortinet.com/e695d42b-da79-4aea-a431-9c26a090cea3
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/gif
Content-Length
43
https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims
abm-tracking.demandscience.com/page-tracking/fortinet_2712/
2 B
665 B
Script
General
Full URL
https://abm-tracking.demandscience.com/page-tracking/fortinet_2712/https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims?visitorId=0ac9c017dfdd772893a32ead8dfce3c5_1731510872543&&clientId=undefined&&cookieEnabled=true
Requested by
Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) / Express
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate
Pragma
no-cache
ETag
W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection
keep-alive
Access-Control-Allow-Methods
GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires
-1
Access-Control-Allow-Origin
*
Content-Length
2
Date
Wed, 13 Nov 2024 15:14:32 GMT
Content-Type
application/json; charset=utf-8
X-Powered-By
Express
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
tracking
tracking.contanuity.com/
2 B
769 B
Script
General
Full URL
https://tracking.contanuity.com/tracking?visitorId=0ac9c017dfdd772893a32ead8dfce3c5_1731510872543&&clientId=undefined&&cookieEnabled=true
Requested by
Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.203.236.163 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-203-236-163.us-west-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) / Express
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate
Pragma
no-cache
ETag
W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection
keep-alive
Access-Control-Allow-Methods
GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires
-1
Access-Control-Allow-Origin
*
Content-Length
2
Date
Wed, 13 Nov 2024 15:14:32 GMT
Content-Type
application/json; charset=utf-8
X-Powered-By
Express
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
gtm.js
www.googletagmanager.com/
192 KB
69 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-M4NSPPXN
Requested by
Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2008 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
210d3777699e981b1087ef862308f1099b508aab100f46aae7eeedc339f030be
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires
Wed, 13 Nov 2024 15:14:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 13 Nov 2024 15:14:32 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
70471
x-xss-protection
0
server
Google Tag Manager
usersync
tracking.contanuity.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1731510872543
  • https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1731510872543&_bee_ppp=1
  • https://tracking.contanuity.com/usersync?bwcookie=AAJRv07OaYUAABZ936JzlA
0
0

/
pixels.argusplatform.com/wh/track/
205 B
468 B
XHR
General
Full URL
https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1731510873640535871&event_type=page_request&timestamp=1731510873&page_title=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&page_url_referer=
Requested by
Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

request-context
appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security
max-age=31536000
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/json; charset=utf-8
x-azure-ref
20241113T151433Z-167698cbc64thbljhC1BN1b0zc0000000hgg00000000md06
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=30ffca77-8036-428a-8088-af95c12fe50d&session=acfab952-1775-4d90-874f-268f5cf0e5c6&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A32%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%222010%22%7D&isIframe=false&m=%7B%22description%22%3A%22See%20how%20threat%20actors%20have%20abused%20Remcos%20to%20collect%20sensitive%20information%20from%20victims%20and%20remotely%20control%20their%20computers%20to%20perform%20further%20malicious%20acts.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Crat%22%2C%22title%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pageViewId=8b4f0ce7-6864-4bf1-8a01-a83317d35573&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.29
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"63f020a0-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 15:14:33 GMT
accept-ranges
bytes
content-length
43
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
image/gif
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
2 KB
1 KB
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
d8d035718c0398cf5747619ac3ab6841befefe89040395fe94376d50e1599d29
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
755
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RC7be3d22b2fd6487ca9390477738587fe-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
819 B
781 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC7be3d22b2fd6487ca9390477738587fe-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
7bfb525912849c73e691a90795cb2e3ce02a95afa8b21db37208591610d75849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
501
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RC407b573180554ea6b11eecdc31ecbd3f-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
819 B
780 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC407b573180554ea6b11eecdc31ecbd3f-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
fba345f22ace7548de35132830525fadbfde71c86c8191fca1b24e6f7dab7eb7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
499
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RC8c594cd344f84ab89afc779d8f53fff4-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
1 KB
835 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC8c594cd344f84ab89afc779d8f53fff4-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
6f8ea4bfcb15d37d8476e99bd6f64d88cca6fc000b8fa4cf0e06855a4710096d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
554
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RC5915f5d7e33546579cd5fd510349ed90-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
722 B
739 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC5915f5d7e33546579cd5fd510349ed90-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
0a8b3c914545d7ab159c36e40602b0c360897355b29cd8967fc83cb3e489a2d3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
458
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RC1d92f04752ae42a38e54de48cb85adf4-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
661 B
672 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC1d92f04752ae42a38e54de48cb85adf4-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
3ae06367235ffbfe4f618e57467802343ea96fa0235b4f953b7c928b1674b702
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
391
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RCf940460311f349b5af69d075bdef61d4-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
368 B
515 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RCf940460311f349b5af69d075bdef61d4-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
cf4179f9a669a40a63939143f20729f61b798e084db5124f008170868315281c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
234
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
754 B
728 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
d742917b312cdf1c37ee321034219943eee051857fbf60833c90e449c43392c9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
447
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
2 KB
994 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
81e93e51e78a978d2c4dc717fb236195baba3623fdf924b70513b300914730f6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
713
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
1021 B
880 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
72996417e47cfa9d2e1d6695c304cc0830d33f5350191ab9d092d93738db9b1c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
600
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
819 B
781 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
da777cb7cdc9dbdf45de521b6c9bcd8fd370e17db390438f64ea29def6efca82
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
501
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
388 B
522 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
b8084072016d0b8e5ad1a96a2bd64333d325d0c3ac55f45112bfaf353743ec59
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
242
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RC5c60a51709a94068afbf065e1448b617-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
664 B
681 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC5c60a51709a94068afbf065e1448b617-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
f57569593403f502d6e83f7ca44d3371a7f6e9b0c409561f69c73f22eb63f700
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
401
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RCf30ab81c91bc4e9c9063a3e8818e020f-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
706 B
730 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RCf30ab81c91bc4e9c9063a3e8818e020f-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
25f6404b0bab974a632fc3d8adfe559b6c9e85e2b461f47a915ed2796901f035
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
449
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
2 KB
1005 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
3e75053eb73861e42602ca4075a48ad1a004f507ca9949210cfd09517114cc72
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
724
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/
966 B
832 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/e65b3d3bd1f9/RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2080::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
e9e270584c7610f3031d6db0eeaabb7c4de7f595726d66d2a07844758a9c7b27
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"e4025e557089d49e2fc1f023a01abf25:1730940563.547746"
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 16:14:33 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.fortinet.com
content-length
551
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/x-javascript
last-modified
Thu, 07 Nov 2024 00:49:23 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
p
i.simpli.fi/
798 B
761 B
Script
General
Full URL
https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp
Requested by
Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.245.15.98 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
98.15.245.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
62b85cd581a8ec3c3a487aee9542df9b8738fbab7310182ea20820594db0f4a3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding
gzip
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
openresty
favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/
318 B
2 KB
Other
General
Full URL
https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache /
Resource Hash
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims

Response headers

X-Vhost
publish
Content-Encoding
gzip
ETag
"13e-565c628eb6a00-gzip"
Age
1093139
X-Content-Type-Options
nosniff
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
fT8MsyaT637KEfAflFOxry9AiwQfeNCpDGMCaAe-b3zfw--mJhjK1w==
Date
Thu, 31 Oct 2024 23:36:46 GMT
Content-Type
image/vnd.microsoft.icon
Last-Modified
Thu, 22 Feb 2018 05:17:28 GMT
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Cache-Control
max-age=2000000, public
X-Dispatcher
dispatcher1uswest1-28559594
Connection
keep-alive
Via
1.1 87e6563b344d9d0eb9b5aa233652bc74.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
133
X-XSS-Protection
1; mode=block
X-Amz-Cf-Pop
IAD61-P2
Server
Apache
v1
match.sharethrough.com/sync/
Redirect Chain
  • https://um.simpli.fi/smaato
  • https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=EBC60905896D45418C0F1FB7F86AC98D
  • https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=b1d8034279&gdpr=0&gdpr_consent=
68 B
324 B
Image
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=b1d8034279&gdpr=0&gdpr_consent=
Protocol
H2
Server
52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-202-124-0.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

cache-control
no-cache, must-revalidate
location
https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=b1d8034279&gdpr=0&gdpr_consent=
via
1.1 eec9650f8780839ac07df0892de9ac88.cloudfront.net (CloudFront)
x-cache
Miss from cloudfront
content-length
0
x-amz-cf-id
pbPdqN7D0fujf4at9fv0A93i2GYmKttsQU3ZQUjKgQ-85mDEZiDQyA==
date
Wed, 13 Nov 2024 15:14:33 GMT
x-amz-cf-pop
JFK52-P7
server
CloudFront
EBC60905896D45418C0F1FB7F86AC98D
sync.1rx.io/usersync/simplifi/
Redirect Chain
  • https://um.simpli.fi/nexxen
  • https://sync.1rx.io/usersync/simplifi/EBC60905896D45418C0F1FB7F86AC98D
0
99 B
Image
General
Full URL
https://sync.1rx.io/usersync/simplifi/EBC60905896D45418C0F1FB7F86AC98D
Protocol
H2
Server
69.194.240.13 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

expires
0
cache-control
no-store, no-cache, must-revalidate
date
Wed, 13 Nov 2024 15:14:17 GMT
pragma
no-cache

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://sync.1rx.io/usersync/simplifi/EBC60905896D45418C0F1FB7F86AC98D
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Tue, 12 Nov 2024 15:14:33 GMT
access-control-allow-origin
*
content-length
142
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
xuid
eb2.3lift.com/
Redirect Chain
  • https://um.simpli.fi/triplelift
  • https://eb2.3lift.com/xuid?mid=7969&xuid=EBC60905896D45418C0F1FB7F86AC98D&dongle=yf3
  • https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=EBC60905896D45418C0F1FB7F86AC98D&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
37 B
474 B
Image
General
Full URL
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=EBC60905896D45418C0F1FB7F86AC98D&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, no-store, must-revalidate
location
/xuid?ld=1&mid=7969&xuid=EBC60905896D45418C0F1FB7F86AC98D&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date
Wed, 13 Nov 2024 15:14:33 GMT
sync
simplifi.partners.tremorhub.com/
Redirect Chain
  • https://um.simpli.fi/telaria_p
  • https://simplifi.partners.tremorhub.com/sync?UISF=EBC60905896D45418C0F1FB7F86AC98D
43 B
175 B
Image
General
Full URL
https://simplifi.partners.tremorhub.com/sync?UISF=EBC60905896D45418C0F1FB7F86AC98D
Protocol
H2
Server
2600:1f18:612b:4216:8b4:d7c1:7102:1a81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
image/gif
server
nginx

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://simplifi.partners.tremorhub.com/sync?UISF=EBC60905896D45418C0F1FB7F86AC98D
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Tue, 12 Nov 2024 15:14:33 GMT
access-control-allow-origin
*
content-length
142
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain
  • https://um.simpli.fi/tapad
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=EBC60905896D45418C0F1FB7F86AC98D
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=EBC60905896D45418C0F1FB7F86AC98D
95 B
428 B
Image
General
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=EBC60905896D45418C0F1FB7F86AC98D
Protocol
H2
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
Jetty(11.0.13) /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
95
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
image/png
server
Jetty(11.0.13)

Redirect headers

strict-transport-security
max-age=31536000
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=EBC60905896D45418C0F1FB7F86AC98D
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
0
date
Wed, 13 Nov 2024 15:14:33 GMT
server
Jetty(11.0.13)
empty.gif
um.simpli.fi/
Redirect Chain
  • https://um.simpli.fi/ad_advisor
  • https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=EBC60905896D45418C0F1FB7F86AC98D
  • https://d.agkn.com/pixel/10751/?che=1731510873974&ip=38.132.118.70&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D214530605065014038469
  • https://um.simpli.fi/aa_px?sk=214530605065014038469
  • https://um.simpli.fi/empty.gif
43 B
361 B
Image
General
Full URL
https://um.simpli.fi/empty.gif
Protocol
H2
Server
34.150.170.96 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
96.170.150.34.bc.googleusercontent.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
43
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
location
/empty.gif
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
content-length
142
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain
  • https://um.simpli.fi/intentiq
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EBC60905896D45418C0F1FB7F86AC98D
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EBC60905896D45418C0F1FB7F86AC98D&ckls=true&ci=KRUk79Xjqm&nc=false&trid=699923177
43 B
1 KB
Image
General
Full URL
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EBC60905896D45418C0F1FB7F86AC98D&ckls=true&ci=KRUk79Xjqm&nc=false&trid=699923177
Protocol
H2
Server
2600:9000:2073:6600:1b:6b7d:2300:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 c57d1eb27f41d3e95fc5060845849c06.cloudfront.net (CloudFront)
expires
Thu, 01 Jan 1970 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length
43
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
x-amz-cf-pop
IAD50-C2
x-amz-cf-id
QBVbwxEM_WdysVcXMXqxLwS5_lY4Kv2eMClubIA0ZrDyOAvZPWAT6A==

Redirect headers

patent
https://www.almondnet.com/ip
cache-control
no-cache, no-store, must-revalidate
location
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EBC60905896D45418C0F1FB7F86AC98D&ckls=true&ci=KRUk79Xjqm&nc=false&trid=699923177
pragma
no-cache
via
1.1 c57d1eb27f41d3e95fc5060845849c06.cloudfront.net (CloudFront)
expires
Thu, 01 Jan 1970 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
content-length
43
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
x-amz-cf-pop
IAD50-C2
x-amz-cf-id
kB1MitEXHl2T6tnfdrVv09eFC-JHC54If2NMMYLn0lzgSf0m5X-rNg==
Pug
image2.pubmatic.com/AdServer/
Redirect Chain
  • https://um.simpli.fi/pubmatic
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:EBC60905896D45418C0F1FB7F86AC98D
42 B
552 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:EBC60905896D45418C0F1FB7F86AC98D
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-store, no-cache, private
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Wed, 13 Nov 2024 15:14:32 GMT
content-type
image/gif; charset=utf-8
server
nginx

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:EBC60905896D45418C0F1FB7F86AC98D
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Tue, 12 Nov 2024 15:14:33 GMT
access-control-allow-origin
*
content-length
142
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
user-registering
ads.stickyadstv.com/
Redirect Chain
  • https://um.simpli.fi/freewheel
  • https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=EBC60905896D45418C0F1FB7F86AC98D
43 B
656 B
Image
General
Full URL
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=EBC60905896D45418C0F1FB7F86AC98D
Protocol
HTTP/1.1
Server
63.251.28.210 Secaucus, United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Transfer-Encoding
chunked
Cache-Control
no-cache
Pragma
no-cache
x-sticky-vk
1731510874155017-1174
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Date
Wed, 13 Nov 2024 15:14:34 GMT
Content-Type
image/gif
Server
nginx

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=EBC60905896D45418C0F1FB7F86AC98D
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Tue, 12 Nov 2024 15:14:33 GMT
access-control-allow-origin
*
content-length
142
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
engine
pbid.pro-market.net/
Redirect Chain
  • https://um.simpli.fi/dtnx
  • https://fei.pro-market.net/engine?du=24;csync=EBC60905896D45418C0F1FB7F86AC98D;mimetype=img;
  • https://fei.pro-market.net/engine?du=24;csync=EBC60905896D45418C0F1FB7F86AC98D;mimetype=img;sr
  • https://cms.analytics.yahoo.com/cms?partner_id=DATCS
  • https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS
  • https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-txtbMrdE2pTZ9W5Me5vq2bLhmOZjy.k1FVQ-~A
43 B
404 B
Image
General
Full URL
https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-txtbMrdE2pTZ9W5Me5vq2bLhmOZjy.k1FVQ-~A
Protocol
H2
Server
2600:1901:0:8eee:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
access-control-allow-credentials
true
via
1.1 google
anserver
gapp8.us1
expires
Mon, 1 Jan 1990 0:0:0 GMT
access-control-allow-origin
*
alt-svc
clear
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length
43
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
image/gif
server
Apache-Coyote/1.1

Redirect headers

strict-transport-security
max-age=31536000
location
https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-txtbMrdE2pTZ9W5Me5vq2bLhmOZjy.k1FVQ-~A
age
0
referrer-policy
no-referrer-when-downgrade
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
text/html
server
ATS
/
loadm.exelator.com/load/
Redirect Chain
  • https://um.simpli.fi/exelatem
  • https://loadm.exelator.com/load/?p=204&g=2191&simid=EBC60905896D45418C0F1FB7F86AC98D&j=0
  • https://loadm.exelator.com/load/?p=204&g=2191&simid=EBC60905896D45418C0F1FB7F86AC98D&j=0&xl8blockcheck=1
0
771 B
Image
General
Full URL
https://loadm.exelator.com/load/?p=204&g=2191&simid=EBC60905896D45418C0F1FB7F86AC98D&j=0&xl8blockcheck=1
Protocol
H2
Server
52.0.156.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-0-156-250.compute-1.amazonaws.com
Software
nginx / Undertow/1
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-cache
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date
Wed, 13 Nov 2024 15:14:34 GMT
x-powered-by
Undertow/1
server
nginx
access-control-allow-credentials
true

Redirect headers

cache-control
no-cache
location
https://loadm.exelator.com/load/?p=204&g=2191&simid=EBC60905896D45418C0F1FB7F86AC98D&j=0&xl8blockcheck=1
access-control-allow-credentials
true
content-length
0
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
x-powered-by
Undertow/1
server
nginx
sync
ups.analytics.yahoo.com/ups/55964/
Redirect Chain
  • https://um.simpli.fi/yahoo
  • https://ups.analytics.yahoo.com/ups/55964/sync?uid=EBC60905896D45418C0F1FB7F86AC98D
  • https://ups.analytics.yahoo.com/ups/55964/sync?uid=EBC60905896D45418C0F1FB7F86AC98D&verify=true
0
123 B
Image
General
Full URL
https://ups.analytics.yahoo.com/ups/55964/sync?uid=EBC60905896D45418C0F1FB7F86AC98D&verify=true
Protocol
H2
Server
2001:4998:1c:800::1000 , United States, ASN14779 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date
Wed, 13 Nov 2024 15:14:34 GMT
age
0
content-type
text/html
server
ATS
referrer-policy
no-referrer-when-downgrade

Redirect headers

strict-transport-security
max-age=31536000
location
https://ups.analytics.yahoo.com/ups/55964/sync?uid=EBC60905896D45418C0F1FB7F86AC98D&verify=true
age
0
referrer-policy
no-referrer-when-downgrade
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
text/html
server
ATS
sync
sync.bfmio.com/
Redirect Chain
  • https://um.simpli.fi/beachfront
  • https://sync.bfmio.com/sync?pid=141&uid=EBC60905896D45418C0F1FB7F86AC98D
0
421 B
Image
General
Full URL
https://sync.bfmio.com/sync?pid=141&uid=EBC60905896D45418C0F1FB7F86AC98D
Protocol
HTTP/1.1
Server
44.208.126.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-208-126-163.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Date
Wed, 13 Nov 2024 15:14:33 GMT
Connection
keep-alive

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://sync.bfmio.com/sync?pid=141&uid=EBC60905896D45418C0F1FB7F86AC98D
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Tue, 12 Nov 2024 15:14:33 GMT
access-control-allow-origin
*
content-length
142
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
29931
stags.bluekai.com/site/
Redirect Chain
  • https://um.simpli.fi/bluekai
  • https://stags.bluekai.com/site/29931?id=EBC60905896D45418C0F1FB7F86AC98D
27 B
27 B
Image
General
Full URL
https://stags.bluekai.com/site/29931?id=EBC60905896D45418C0F1FB7F86AC98D
Protocol
HTTP/1.1
Server
23.197.253.128 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-253-128.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5607bc0b49036b5f13acf3f5767e0fb2fb947f5369bda253939e78e2b11f85b4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Connection
keep-alive
Expires
Wed, 13 Nov 2024 15:14:34 GMT
Content-Length
27
Date
Wed, 13 Nov 2024 15:14:34 GMT
AK-GRN
0.b304d217.1731510874.104fc8ce
Content-Type
text/html

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://stags.bluekai.com/site/29931?id=EBC60905896D45418C0F1FB7F86AC98D
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Tue, 12 Nov 2024 15:14:33 GMT
access-control-allow-origin
*
content-length
142
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
tpid=EBC60905896D45418C0F1FB7F86AC98D
bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/
Redirect Chain
  • https://um.simpli.fi/crwdcntrl
  • https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=EBC60905896D45418C0F1FB7F86AC98D
  • https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=EBC60905896D45418C0F1FB7F86AC98D
49 B
545 B
Image
General
Full URL
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=EBC60905896D45418C0F1FB7F86AC98D
Protocol
H2
Server
35.175.35.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-175-35-80.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-cache
pragma
no-cache
expires
0
access-control-allow-origin
*
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
49
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
x-server
10.40.60.134
server
Jetty(9.4.38.v20210224)

Redirect headers

cache-control
no-cache
location
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=EBC60905896D45418C0F1FB7F86AC98D
pragma
no-cache
expires
0
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
0
date
Wed, 13 Nov 2024 15:14:34 GMT
x-server
10.40.56.50
server
Jetty(9.4.38.v20210224)
merge
ce.lijit.com/
Redirect Chain
  • https://um.simpli.fi/lj_match
  • https://ce.lijit.com/merge?pid=2&3pid=EBC60905896D45418C0F1FB7F86AC98D
  • https://ce.lijit.com/merge?pid=2&3pid=EBC60905896D45418C0F1FB7F86AC98D&dnr=1
43 B
513 B
Image
General
Full URL
https://ce.lijit.com/merge?pid=2&3pid=EBC60905896D45418C0F1FB7F86AC98D&dnr=1
Protocol
H2
Server
54.166.218.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-166-218-157.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma
no-cache
expires
Fri, 20 Mar 2009 00:00:00 GMT
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
vary
Accept-Encoding

Redirect headers

cache-control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location
https://ce.lijit.com/merge?pid=2&3pid=EBC60905896D45418C0F1FB7F86AC98D&dnr=1
pragma
no-cache
expires
Fri, 20 Mar 2009 00:00:00 GMT
content-length
0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 13 Nov 2024 15:14:34 GMT
vary
Accept-Encoding
db_sync
px.ads.linkedin.com/
Redirect Chain
  • https://um.simpli.fi/liveramp_match
  • https://idsync.rlcdn.com/419566.gif?partner_uid=EBC60905896D45418C0F1FB7F86AC98D
  • https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogRUJDNjA5MDU4OTZENDU0MThDMEYxRkI3Rjg2QUM5OEQQABoNCNqE07kGEgUI6AcQAEIASgA
  • https://pippio.com/api/sync?pid=5324&it=1&iv=8cdee6c7edd11c2e1f2e4652504c99a774ef975e5f420af4f84ae1c390da9028791426b5417dce21&_=2
  • https://px.ads.linkedin.com/db_sync?pid=10339&puuid=8cdee6c7edd11c2e1f2e4652504c99a774ef975e5f420af4f84ae1c390da9028791426b5417dce21&rand=08978028
  • https://px.ads.linkedin.com/db_sync?pid=10339&puuid=8cdee6c7edd11c2e1f2e4652504c99a774ef975e5f420af4f84ae1c390da9028791426b5417dce21&rand=08978028&expected_cookie=69c93d21-9e4d-4fad-ba7b-1141f0b75d1e
0
142 B
Image
General
Full URL
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=8cdee6c7edd11c2e1f2e4652504c99a774ef975e5f420af4f84ae1c390da9028791426b5417dce21&rand=08978028&expected_cookie=69c93d21-9e4d-4fad-ba7b-1141f0b75d1e
Protocol
H2
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 1483435DE4A84545AFEFB6A6532DC528 Ref B: MIAEDGE1314 Ref C: 2024-11-13T15:14:34Z
x-li-fabric
prod-ltx1
x-li-uuid
AAYmzMqX0Pxvs8wcq5QAgg==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Wed, 13 Nov 2024 15:14:34 GMT

Redirect headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
location
/db_sync?pid=10339&puuid=8cdee6c7edd11c2e1f2e4652504c99a774ef975e5f420af4f84ae1c390da9028791426b5417dce21&rand=08978028&expected_cookie=69c93d21-9e4d-4fad-ba7b-1141f0b75d1e
x-msedge-ref
Ref A: 58CC5D8242B240C0AA4CE23BB5A2D66B Ref B: MIAEDGE1314 Ref C: 2024-11-13T15:14:34Z
x-li-fabric
prod-ltx1
x-li-uuid
AAYmzMqWheczp4SaACTvCg==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Wed, 13 Nov 2024 15:14:33 GMT
/
www.google.com/pagead/1p-conversion/1026675585/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1026675585/?random=1731510873508&cv=7&fst=1731510873508&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1487343483&cv=7&fst=1731510873508&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLH...
  • https://www.google.com/pagead/1p-conversion/1026675585/?random=1487343483&cv=7&fst=1731510873508&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHD...
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-conversion/1026675585/?random=1487343483&cv=7&fst=1731510873508&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOrGsQIIo8WxAgjTxbECCKXGsQI&pscrd=IhMIvbe01MzZiQMVtzmICR3-kD0aMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSGwCa7L7dJgZTEV2LT3Ed64knzkzUvG2GkFQq_Q&random=2429023288
Protocol
H3
Server
142.251.40.100 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Wed, 13 Nov 2024 15:14:34 GMT
x-xss-protection
0
content-type
image/gif
server
cafe

Redirect headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
location
https://www.google.com/pagead/1p-conversion/1026675585/?random=1487343483&cv=7&fst=1731510873508&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOrGsQIIo8WxAgjTxbECCKXGsQI&pscrd=IhMIvbe01MzZiQMVtzmICR3-kD0aMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSGwCa7L7dJgZTEV2LT3Ed64knzkzUvG2GkFQq_Q&random=2429023288
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
42
date
Wed, 13 Nov 2024 15:14:33 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
spotx_match
um.simpli.fi/
0
272 B
Image
General
Full URL
https://um.simpli.fi/spotx_match
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
34.150.170.96 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
96.170.150.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-allow-methods
GET, POST, OPTIONS
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin
*
date
Wed, 13 Nov 2024 15:14:33 GMT
x-content-type-options
nosniff
bounce
ib.adnxs.com/
Redirect Chain
  • https://um.simpli.fi/an
  • https://ib.adnxs.com/setuid?entity=66&code=EBC60905896D45418C0F1FB7F86AC98D
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DEBC60905896D45418C0F1FB7F86AC98D
43 B
1 KB
Image
General
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DEBC60905896D45418C0F1FB7F86AC98D
Protocol
H2
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.23.4 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
38.132.118.70; 38.132.118.70; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
2f59b0c2-8121-4561-99a4-cdb2236087d1
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 13 Nov 2024 15:14:34 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.23.4

Redirect headers

cache-control
no-store, no-cache, private
location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DEBC60905896D45418C0F1FB7F86AC98D
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
38.132.118.70; 38.132.118.70; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
1032f04d-14aa-4964-8a2d-c147a160a515
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 13 Nov 2024 15:14:34 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.23.4
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://um.simpli.fi/rb_match
  • https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=EBC60905896D45418C0F1FB7F86AC98D&expires=365
42 B
1 KB
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=EBC60905896D45418C0F1FB7F86AC98D&expires=365
Protocol
HTTP/1.1
Server
69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
4581d8330ee81d8f36e15dba6d5b7f41
Pragma
no-cache
content-length
42
Content-Type
image/gif

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=EBC60905896D45418C0F1FB7F86AC98D&expires=365
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Tue, 12 Nov 2024 15:14:33 GMT
access-control-allow-origin
*
content-length
142
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://um.simpli.fi/ox_match
  • https://us-u.openx.net/w/1.0/sd?id=537072966&val=EBC60905896D45418C0F1FB7F86AC98D
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=EBC60905896D45418C0F1FB7F86AC98D
43 B
171 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=EBC60905896D45418C0F1FB7F86AC98D
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
image/gif
vary
Accept
server
OXGW/0.0.0

Redirect headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=EBC60905896D45418C0F1FB7F86AC98D
p3p
CP="CUR ADM OUR NOR STA NID"
content-length
0
date
Wed, 13 Nov 2024 15:14:33 GMT
server
OXGW/0.0.0
g_match
um.simpli.fi/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm=&google_sc=&google_tc=
  • https://um.simpli.fi/g_match?id=&google_gid=CAESEG_u-t0pKzu7FLCo7Wibd-4&google_cver=1
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=EBC60905896D45418C0F1FB7F86AC98D
  • https://um.simpli.fi/g_match?id=
0
320 B
Image
General
Full URL
https://um.simpli.fi/g_match?id=
Protocol
H2
Server
34.150.170.96 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
96.170.150.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
access-control-allow-methods
GET, POST, OPTIONS
x-content-type-options
nosniff
expires
Tue, 12 Nov 2024 15:14:34 GMT
access-control-allow-origin
*
date
Wed, 13 Nov 2024 15:14:34 GMT
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

cache-control
no-cache, must-revalidate
location
https://um.simpli.fi/g_match?id=
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
229
date
Wed, 13 Nov 2024 15:14:34 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
spx
dx.mountain.com/
23 KB
6 KB
Script
General
Full URL
https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cb=92537636318304260term=value
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.209.137.118 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-209-137-118.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
98487405c7f3625d1f0566a9e58f1dfd35eb5252853f41c33031faccd5c9f0d4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

transfer-encoding
chunked
content-encoding
gzip
x-envoy-upstream-service-time
1
expires
Thu, 01 Jan 1970 00:00:00 GMT
be
spx-prod
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/javascript;charset=utf-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
server
istio-envoy
uwt.js
static.ads-twitter.com/
57 KB
16 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.44.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

vary
Accept-Encoding,Host
cache-control
no-cache
content-encoding
gzip
etag
"4328e910de583ad53b3a7a76455af005+gzip+gzip"
accept-ranges
bytes
x-cache
HIT, HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length
15926
date
Wed, 13 Nov 2024 15:14:33 GMT
x-tw-cdn
FT
last-modified
Tue, 29 Oct 2024 01:22:31 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-iad-kiad7000145-IAD, cache-nyc-kteb1890071-NYC
x-amz-server-side-encryption
AES256
insight.min.js
snap.licdn.com/li.lms-analytics/
40 KB
14 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:b000::173b:fbd3 Newark, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=81506
content-encoding
gzip
x-cdn
AKAM
x-content-type-options
nosniff
accept-ranges
bytes
content-length
14628
date
Wed, 13 Nov 2024 15:14:33 GMT
last-modified
Thu, 22 Aug 2024 11:06:54 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
x-amz-server-side-encryption
AES256
events.js
tags.srv.stackadapt.com/
22 KB
8 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.44.251.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-44-251-75.compute-1.amazonaws.com
Software
/
Resource Hash
9a819eb7f895fba3c35832391cea5a27f7960e6c478513a025283df2f6f21641

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-allow-origin
*
cache-control
max-age=5
content-encoding
gzip
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
text/javascript
bounce
secure.adnxs.com/
Redirect Chain
  • https://secure.adnxs.com/px?id=1773420&t=2
  • https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
43 B
1 KB
Image
General
Full URL
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
Protocol
H2
Server
68.67.179.153 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.23.4 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
38.132.118.70; 38.132.118.70; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
447d24ca-4220-495d-b054-ede640a6ddf8
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 13 Nov 2024 15:14:34 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.23.4

Redirect headers

cache-control
no-store, no-cache, private
location
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
38.132.118.70; 38.132.118.70; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
4298f21e-2bda-44cf-a680-81b07d521636
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 13 Nov 2024 15:14:34 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.23.4
bounce
ib.adnxs.com/
Redirect Chain
  • https://ib.adnxs.com/seg?add=36113683
  • https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
43 B
1 KB
Image
General
Full URL
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
Protocol
H2
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.23.4 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
38.132.118.70; 38.132.118.70; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
733c45b8-67a7-4321-ad4f-ec4df446ff07
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 13 Nov 2024 15:14:34 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.23.4

Redirect headers

cache-control
no-store, no-cache, private
location
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
38.132.118.70; 38.132.118.70; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
cea24712-08a1-455f-b934-3011a168d444
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 13 Nov 2024 15:14:34 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.23.4
iztag.js
tags.inzynk.io/0ulh3gex/
34 B
441 B
Script
General
Full URL
https://tags.inzynk.io/0ulh3gex/iztag.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f9:6600:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-encoding
x-amz-version-id
15XT7F8rursoJ6jHrhKIXrYdXTZkWasY
etag
"595f7fa79bc22a7029d2751228622eb4"
age
84277
via
1.1 20807453c5a15da53ec1d3eb5e2fdcca.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
34
x-amz-cf-id
YEyiqkG75BcVFI9bCm_pAJGK_kmzHRLVdQ8N-Blzi9e_31MjR3MAsg==
date
Tue, 12 Nov 2024 15:50:41 GMT
content-type
application/octet-stream
last-modified
Thu, 05 Sep 2024 13:11:02 GMT
server
AmazonS3
x-amz-cf-pop
JFK52-P10
x-amz-server-side-encryption
AES256
adsct
t.co/i/
43 B
628 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=4c0b5c75-62c6-4c97-abc1-9170a517b82c&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=de88b2fa-5f30-43c3-8d86-032fa498a2f6&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.31
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=0
x-transaction-id
b945551276f85315
cache-control
no-cache, no-store, max-age=0
x-connection-hash
54e9953c70d20750e5b9df00abef4d767a80da67290cfb71c8a72250c26b1fed
cf-cache-status
DYNAMIC
cf-ray
8e1fb653398b743a-MIA
x-response-time
6
content-length
43
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif;charset=utf-8
perf
7402827104
server
cloudflare tsa_b
adsct
analytics.twitter.com/i/
43 B
215 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=4c0b5c75-62c6-4c97-abc1-9170a517b82c&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=de88b2fa-5f30-43c3-8d86-032fa498a2f6&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.31
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=631138519
x-transaction-id
35ed689ca66b4676
cache-control
no-cache, no-store, max-age=0
x-connection-hash
5da73a9d27486a303b52d2d3bc85983c6a7a44b441fda15bac39ab67b94479bd
x-response-time
7
content-length
43
date
Wed, 13 Nov 2024 15:14:33 GMT
perf
7402827104
content-type
image/gif;charset=utf-8
server
tsa_b
adsct
t.co/i/
43 B
469 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=7b3e487f-6ada-4f0c-a840-44c3fd709192&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=de88b2fa-5f30-43c3-8d86-032fa498a2f6&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.31
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=0
x-transaction-id
59a2a26b07036233
cache-control
no-cache, no-store, max-age=0
x-connection-hash
1fa8f17e80ed3d32e7a5ff20bf3bb25d0b2d1dd97b369e828eb7c05274a0e061
cf-cache-status
DYNAMIC
cf-ray
8e1fb653398d743a-MIA
x-response-time
82
content-length
43
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif;charset=utf-8
perf
7402827104
server
cloudflare tsa_b
adsct
analytics.twitter.com/i/
43 B
393 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=7b3e487f-6ada-4f0c-a840-44c3fd709192&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=de88b2fa-5f30-43c3-8d86-032fa498a2f6&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.31
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=631138519
x-transaction-id
63894a01d962c635
cache-control
no-cache, no-store, max-age=0
x-connection-hash
5da73a9d27486a303b52d2d3bc85983c6a7a44b441fda15bac39ab67b94479bd
x-response-time
4
content-length
43
date
Wed, 13 Nov 2024 15:14:33 GMT
perf
7402827104
content-type
image/gif;charset=utf-8
server
tsa_b
is
52.22.50.55/
32 B
437 B
Fetch
General
Full URL
https://52.22.50.55/is?cb=1731510873837
Requested by
Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cb=92537636318304260term=value
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.22.50.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-22-50-55.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
ecdf429fda499cefeec5316b2650abe996a2dcf09a16dbd4a4b4aeab971ef550

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time
1
connection
close
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
x-application-context
application:prod:8080
content-length
32
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
text/plain;charset=utf-8
server
istio-envoy
access-control-allow-headers
Accept, Content-Type, x-requested-with, X-Custom-Header
attribution_trigger
px.ads.linkedin.com/
2 B
761 B
XHR
General
Full URL
https://px.ads.linkedin.com/attribution_trigger?pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
*
Referer
https://www.fortinet.com/

Response headers

x-li-pop
afd-prod-ltx1-x
content-encoding
gzip
x-fs-uuid
000626ccca93f74101c8c44bf13cc66f
x-msedge-ref
Ref A: 7F74FC085E224B8BA666649C0AF19CEC Ref B: MIAEDGE1416 Ref C: 2024-11-13T15:14:34Z
x-li-fabric
prod-ltx1
x-restli-protocol-version
1.0.0
access-control-allow-methods
GET, OPTIONS
x-li-uuid
AAYmzMqT90EByMRL8TzGbw==
x-li-proto
http/2
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Wed, 13 Nov 2024 15:14:33 GMT
content-type
application/json
access-control-allow-headers
*
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&li_adsId=3d8f9782-d2b9-4b41-8d7a-4f830082a068&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&li_adsId=3d8f9782-d2b9-4b41-8d7a-4f830082a068&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%252C6313418%26time%3D1731510874029%26li_adsId%3D3d8f...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&li_adsId=3d8f9782-d2b9-4b41-8d7a-4f830082a068&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&li_adsId=3d8f9782-d2b9-4b41-8d7a-4f830082a068&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Ft...
0
489 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&li_adsId=3d8f9782-d2b9-4b41-8d7a-4f830082a068&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cookiesTest=true&liSync=true&e_ipv6=AQIzeBwyIKAzVAAAAZMmFzHSOrukxvRW4NutgWXFMxNs98EN4jIYSHFk3gVs0pRWIoWxDwY
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: D4317307CCB7494397B2D75E4C5EB99D Ref B: MIAEDGE1809 Ref C: 2024-11-13T15:14:34Z
x-li-fabric
prod-ltx1
x-li-uuid
AAYmzMqc9CrvQ6tSHByuzg==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
application/javascript

Redirect headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1731510874029&li_adsId=3d8f9782-d2b9-4b41-8d7a-4f830082a068&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cookiesTest=true&liSync=true&e_ipv6=AQIzeBwyIKAzVAAAAZMmFzHSOrukxvRW4NutgWXFMxNs98EN4jIYSHFk3gVs0pRWIoWxDwY
x-msedge-ref
Ref A: AEB08500536C49AAAF4B53AA948B7F94 Ref B: MIAEDGE1314 Ref C: 2024-11-13T15:14:34Z
x-li-fabric
prod-ltx1
x-li-uuid
AAYmzMqaXemi8bVEJaib4Q==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Wed, 13 Nov 2024 15:14:34 GMT
sa.css
tags.srv.stackadapt.com/
65 B
203 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.44.251.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-44-251-75.compute-1.amazonaws.com
Software
/
Resource Hash
3d5e2f7e7d7b47abbb9e045643f1f783327593164a1cc826823b86935ea0dc1b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
65
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
text/css
sa.jpeg
tags.srv.stackadapt.com/
0
2 KB
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.44.251.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-44-251-75.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/jpeg
new-campaign-uses-remcos-rat-to-exploit-victims;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4350436164737.9277
10104846.fls.doubleclick.net/activityi;dc_pre=CITQ39TM2YkDFTOMywEdQmstcg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/ Frame AB89
Redirect Chain
  • https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims;dc_lat=;dc_rdi...
  • https://10104846.fls.doubleclick.net/activityi;dc_pre=CITQ39TM2YkDFTOMywEdQmstcg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat...
0
0
Document
General
Full URL
https://10104846.fls.doubleclick.net/activityi;dc_pre=CITQ39TM2YkDFTOMywEdQmstcg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4350436164737.9277?
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.41.6 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f6.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fortinet.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
2175
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 13 Nov 2024 15:14:34 GMT
expires
Wed, 13 Nov 2024 15:14:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 13 Nov 2024 15:14:34 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://10104846.fls.doubleclick.net/activityi;dc_pre=CITQ39TM2YkDFTOMywEdQmstcg;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4350436164737.9277?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
fbevents.js
connect.facebook.net/en_US/
239 KB
61 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.71.7 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-lga3.fbcdn.net
Software
/
Resource Hash
527bf3dacc5eb62211130fe4bf315c682861320ab25b4aa2efe6ea87a760db8c
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: *;script-src 'nonce-2E0XJisk' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-encoding
gzip
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src 'self' data: blob: *;script-src 'nonce-2E0XJisk' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control
public, max-age=1200
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
x-fb-connection-quality
GOOD; q=0.7, rtt=62, rtx=0, c=23, mss=1232, tbw=4446, tp=9, tpl=0, uplat=0, ullat=-1
pragma
public
x-fb-debug
Y9diRcsd9+KX2cgr7OZwAC2Pq+Vd2XI86To0wZ4ZbQyapTt4mBgpZOhxkkDp0ObMo+V0b9nmGwj33NUmuFlSAw==
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top
content-length
62107
x-xss-protection
0
origin-agent-cluster
?1
siteanalyze_6033413.js
siteimproveanalytics.com/js/
39 KB
12 KB
Script
General
Full URL
https://siteimproveanalytics.com/js/siteanalyze_6033413.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.163.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a44bc40527e09426a4c58aa907fdf72074591ea0bcfee1e8c6b2c7056a9eb91

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
"a40813329b017a9369f4c5bd8b5d182e"
age
5535
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vb8ZwBcia%2B7QugsXvcHYZ7dT1D%2BFSiFoYYF5iaDjHJbTl3rUMZYwMInj5XZaFGwG8RZqJKscabJvxDxXDXR1Vi6ALRJVL7SAyVMdlzR6JHfQ5HcsEkd8wvp7Tzoj%2Bokkm1x7nKkAFu4MnVk%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=32873&sent=10&recv=7&lost=0&retrans=0&sent_bytes=4097&recv_bytes=4249&delivery_rate=94550&cwnd=12000&unsent_bytes=0&cid=01349acb2fa29e9d&ts=59&x=1", cfHdrFlush;dur=0
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
application/javascript; charset=utf-8
last-modified
Tue, 29 Oct 2024 20:11:40 GMT
vary
Accept-Encoding
x-amz-id-2
PZr6YXjb0jMb5nhV5vb2gEqP85voqCfhWpNNglgBuQc1Z4c7drKw6MaepM074PtgCAxaTc2xYrc=
cache-control
max-age=86400, no-transform
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
JM3QMDGC8N9K1NHY
cf-ray
8e1fb6542fad7445-MIA
accept-ranges
bytes
content-length
11710
server
cloudflare
adsct
t.co/i/
43 B
164 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=864623c7-41e9-4835-bb16-949cc862296e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=de88b2fa-5f30-43c3-8d86-032fa498a2f6&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.31
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=0
x-transaction-id
569f629b05aac98b
cache-control
no-cache, no-store, max-age=0
x-connection-hash
2deba75ff3316a011c2c48516348edeb58ade13e6ddeaad70f6e7e7222db6a25
cf-cache-status
DYNAMIC
cf-ray
8e1fb653dad8743a-MIA
x-response-time
7
content-length
43
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif;charset=utf-8
perf
7402827104
server
cloudflare tsa_b
adsct
analytics.twitter.com/i/
43 B
93 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=864623c7-41e9-4835-bb16-949cc862296e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=de88b2fa-5f30-43c3-8d86-032fa498a2f6&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.31
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=631138519
x-transaction-id
5835614e44b2fac5
cache-control
no-cache, no-store, max-age=0
x-connection-hash
5da73a9d27486a303b52d2d3bc85983c6a7a44b441fda15bac39ab67b94479bd
x-response-time
8
content-length
43
date
Wed, 13 Nov 2024 15:14:33 GMT
perf
7402827104
content-type
image/gif;charset=utf-8
server
tsa_b
saq_pxl
tags.srv.stackadapt.com/
138 B
333 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=NZlTqtu9vowXrexrDZrWUA&is_js=true&landing_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&t=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&tip=95IlyACVb07VQdsXdvkyEZ9tvCgjQHdQDb-ef9btJxs&host=https%3A%2F%2Fwww.fortinet.com&sa_conv_data_css_value=%270-2c2df343-078c-5f5c-5e20-760050e08db7%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd92c2df343078c5f5c5e20760050e08db726847646&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIAPUedzHQELGu9dQtoE8inZnRYgwfzgcKmWRYGWBTArwENYBGAQg2YTTuQYwAToEQiu0oEIEgtiAFw.waye9oDPz5mzFqyMxnbsZhbBOAc7hjXX3PjkhzuH%252BCU&sa-user-id-v2=s%253ALC3zQweMX1xeIHYAUOCNtyaEdkY.GdEPQUkp2agv5EyFIeXKJWSmX2GpxrT%252BQxumnRcGG50&sa-user-id=s%253A0-2c2df343-078c-5f5c-5e20-760050e08db7.snsH4E%252FAyqmh%252Bl%252Fo2o%252BobQpFCzY%252BZeNI9SaOvxJMKIo
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.44.251.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-44-251-75.compute-1.amazonaws.com
Software
/
Resource Hash
e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-allow-methods
GET
access-control-allow-origin
https://www.fortinet.com
content-length
138
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
text/plain; charset=utf-8
access-control-allow-credentials
true
access-control-allow-headers
*
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=30ffca77-8036-428a-8088-af95c12fe50d&session=acfab952-1775-4d90-874f-268f5cf0e5c6&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A33%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%223014%22%7D&isIframe=false&m=%7B%22description%22%3A%22See%20how%20threat%20actors%20have%20abused%20Remcos%20to%20collect%20sensitive%20information%20from%20victims%20and%20remotely%20control%20their%20computers%20to%20perform%20further%20malicious%20acts.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Crat%22%2C%22title%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pageViewId=8b4f0ce7-6864-4bf1-8a01-a83317d35573&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.29
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"60bb2e15-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 15:14:34 GMT
accept-ranges
bytes
content-length
43
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
tag.aspx
ml314.com/
38 KB
39 KB
Script
General
Full URL
https://ml314.com/tag.aspx?1310
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
79.77.117.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

x-goog-metageneration
1
x-goog-hash
crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
etag
"632616ff15825f030aab3391a58ef042"
age
602
x-goog-stored-content-encoding
identity
x-cache-hit
hit
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
39162
date
Wed, 13 Nov 2024 15:04:32 GMT
last-modified
Wed, 24 Jul 2024 19:30:50 GMT
content-type
application/javascript
x-guploader-uploadid
AHmUCY0itttZPk5Ot59bYoCQFjOU62-opUvN1YdOZBLi1PRnwN_vCvX7DwEqrF-EgmYgtrCWTJtX6cI5cw
cache-control
public,max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
cache-id
MIA-ebd516a
accept-ranges
bytes
x-goog-generation
1721849450340665
content-length
39162
server
UploadServer
sa.jpeg
tags.srv.stackadapt.com/
0
0
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.44.251.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-44-251-75.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/jpeg
/
webtracker.argusplatform.com/wh/track/
205 B
468 B
XHR
General
Full URL
https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1731510873640535871&event_type=page_request&timestamp=1731510874&page_title=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&page_url_referer=
Requested by
Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

request-context
appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security
max-age=31536000
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
application/json; charset=utf-8
x-azure-ref
20241113T151434Z-167698cbc64572n9hC1BN1e8ns00000002n0000000006urb
saq_pxl
tags.srv.stackadapt.com/
138 B
333 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=kcdPQbWRrikzOaW0iSiObg&is_js=true&landing_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&t=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&tip=95IlyACVb07VQdsXdvkyEZ9tvCgjQHdQDb-ef9btJxs&host=https%3A%2F%2Fwww.fortinet.com&sa_conv_data_css_value=%270-2c2df343-078c-5f5c-5e20-760050e08db7%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd92c2df343078c5f5c5e20760050e08db726847646&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIAPUedzHQELGu9dQtoE8inZnRYgwfzgcKmWRYGWBTArwENYBGAQg2YTTuQYwAToEQiu0oEIEgtiAFw.waye9oDPz5mzFqyMxnbsZhbBOAc7hjXX3PjkhzuH%252BCU&sa-user-id-v2=s%253ALC3zQweMX1xeIHYAUOCNtyaEdkY.GdEPQUkp2agv5EyFIeXKJWSmX2GpxrT%252BQxumnRcGG50&sa-user-id=s%253A0-2c2df343-078c-5f5c-5e20-760050e08db7.snsH4E%252FAyqmh%252Bl%252Fo2o%252BobQpFCzY%252BZeNI9SaOvxJMKIo
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.44.251.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-44-251-75.compute-1.amazonaws.com
Software
/
Resource Hash
1ebf4765c39e042319d8cc3f4070ef97c89b6e18a3f28bcec0bb7e58a9042a8f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

access-control-allow-methods
GET
access-control-allow-origin
https://www.fortinet.com
content-length
138
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
text/plain; charset=utf-8
access-control-allow-credentials
true
access-control-allow-headers
*
image.aspx
6033413.global.siteimproveanalytics.io/
34 B
149 B
Image
General
Full URL
https://6033413.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&title=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&res=1600x1200&accountid=6033413&rt=5305&prev=4e4b04c8-5ff9-e592-fe90-f2415fec1d00&luid=0dc5aa93-845d-cf3a-de20-6f6707163bf9&rnd=35461
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.70.150.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-70-150-194.compute-1.amazonaws.com
Software
/
Resource Hash
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

expires
Wed, 13 Nov 2024 15:14:34 UTC
cache-control
max-age=0
content-length
34
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
177020962864941
connect.facebook.net/signals/config/
68 KB
13 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/177020962864941?v=2.9.176&r=stable&domain=www.fortinet.com&hme=872f04a0547459b3285cb03b0d7a47bfde40628f4b386809918a621e2688602f&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.71.7 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-lga3.fbcdn.net
Software
/
Resource Hash
21e1e9c369a99c9d0666d9c115a107d9df16a8a44119fd650fee9f52802269bd
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: *;script-src 'nonce-IcxTPGQj' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-encoding
gzip
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src 'self' data: blob: *;script-src 'nonce-IcxTPGQj' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control
public, max-age=1200
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
x-fb-connection-quality
GOOD; q=0.7, rtt=64, rtx=0, c=76, mss=1232, tbw=70866, tp=67, tpl=0, uplat=1, ullat=-1
pragma
public
x-fb-debug
jAKdExOWe4J/77/Sqfab3eDhJ+IGPcj068cQDYvnB9v8q+0sb+vS52aQVHdjPAz894q2CzlJzhTrdkH/VzTo5Q==
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top
content-length
13472
x-xss-protection
0
origin-agent-cluster
?1
/
www.facebook.com/tr/
0
269 B
Image
General
Full URL
https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&rl=&if=false&ts=1731510874522&sw=1600&sh=1200&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731510874520.984169028892615523&ler=empty&cdl=API_unavailable&it=1731510874441&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-fb-connection-quality
GOOD; q=0.7, rtt=62, rtx=0, c=10, mss=1297, tbw=2901, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
alt-svc
h3=":443"; ma=86400
content-length
0
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
text/plain
server
proxygen-bolt
/
www.facebook.com/privacy_sandbox/pixel/register/trigger/
67 B
3 KB
Image
General
Full URL
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&rl=&if=false&ts=1731510874522&sw=1600&sh=1200&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731510874520.984169028892615523&ler=empty&cdl=API_unavailable&it=1731510874441&coo=false&rqm=FGET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
Security Headers
Name Value
Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-encoding
zstd
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7436782577647117055"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
attribution-reporting-register-trigger
{"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xf77e856888256f1c","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"3":["1473595392721544"]},"debug_reporting":true,"debug_key":"3299205852929532615"}
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/png
vary
Accept-Encoding
x-fb-debug
opjbJb0Lz8Wf+9e+c9Z26A/TTWP5Co7DD4m4zGsvoAkNT9sidTTfd/ljhOK8k2sgunAOyU5uhzfH+Rj33Sa//Q==
x-frame-options
DENY
strict-transport-security
max-age=15552000; preload
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7436782577647117055", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control
private, no-store, no-cache, must-revalidate
x-fb-connection-quality
GOOD; q=0.7, rtt=62, rtx=0, c=10, mss=1297, tbw=3214, tp=-1, tpl=-1, uplat=57, ullat=0
cross-origin-opener-policy
same-origin-allow-popups
pragma
no-cache
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy
force-load-at-top
x-xss-protection
0
origin-agent-cluster
?0
utsync.ashx
ml314.com/
641 B
1 KB
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pv=1731510874545_jz9oaepi7&bl=en-us&cb=4551474&return=&ht=&d=&dc=&si=1731510874545_jz9oaepi7&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1310
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
79.77.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
fa0e1d2d5f211be66b90f05a20ac7030c70c0eed9033d5bde29b91a47a8f034c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 google
expires
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
application/javascript
server
Google Frontend
ibs:dpid=22052&dpuuid=3648398751723683879&redir=
dpm.demdex.net/
42 B
717 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3648398751723683879&redir=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.197.160.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-160-137.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-va6-2-v068-0398b4090.edge-va6.demdex.com 15 ms
content-encoding
gzip
pragma
no-cache
x-content-type-options
nosniff
x-tid
VocbsPmuQlE=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
59
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
csync.ashx
ml314.com/
Redirect Chain
  • https://idsync.rlcdn.com/395886.gif?partner_uid=3648398751723683879
  • https://ml314.com/csync.ashx?fp=b37450a9963f712bd0006be646cbdc8c953266b97ba039d89cd9b5d54b14a71df4cb09cee1a4f8eb&person_id=3648398751723683879&eid=50082
43 B
56 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=b37450a9963f712bd0006be646cbdc8c953266b97ba039d89cd9b5d54b14a71df4cb09cee1a4f8eb&person_id=3648398751723683879&eid=50082
Protocol
H3
Server
34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
79.77.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

via
1.1 google
expires
Thu, 14 Nov 2024 15:14:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
server
Google Frontend

Redirect headers

cache-control
no-cache, no-store
timing-allow-origin
*
location
https://ml314.com/csync.ashx?fp=b37450a9963f712bd0006be646cbdc8c953266b97ba039d89cd9b5d54b14a71df4cb09cee1a4f8eb&person_id=3648398751723683879&eid=50082
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
0
date
Wed, 13 Nov 2024 15:14:34 GMT
utsync.ashx
ml314.com/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
  • https://ml314.com/utsync.ashx?eid=53819&et=0&fp=89de1bef-d89c-48c0-b134-0fb937641c1c&gdpr=0&gdpr_consent=
43 B
61 B
Image
General
Full URL
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=89de1bef-d89c-48c0-b134-0fb937641c1c&gdpr=0&gdpr_consent=
Protocol
H3
Server
34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
79.77.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 google
expires
0,Thu, 14 Nov 2024 15:14:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
server
Google Frontend

Redirect headers

location
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=89de1bef-d89c-48c0-b134-0fb937641c1c&gdpr=0&gdpr_consent=
content-length
241
date
Wed, 13 Nov 2024 15:14:34 GMT
server
Kestrel
csync.ashx
ml314.com/
Redirect Chain
  • https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3648398751723683879%26eid=2
  • https://ml314.com/csync.ashx?fp=6659824704771999787&person_id=3648398751723683879&eid=2
43 B
56 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=6659824704771999787&person_id=3648398751723683879&eid=2
Protocol
H3
Server
34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
79.77.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

via
1.1 google
expires
Thu, 14 Nov 2024 15:14:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 13 Nov 2024 15:14:34 GMT
content-type
image/gif
server
Google Frontend

Redirect headers

cache-control
no-store, no-cache, private
location
https://ml314.com/csync.ashx?fp=6659824704771999787&person_id=3648398751723683879&eid=2
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
38.132.118.70; 38.132.118.70; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
3a3ce45f-d424-464e-9215-e4ed758abef3
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 13 Nov 2024 15:14:34 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.23.4
match
ps.eyeota.net/
Redirect Chain
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2OaFLlhQwGDBLRPail7L6RNjl55D2KUpZqlhY4sQvtcQ&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
70 B
440 B
Image
General
Full URL
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Protocol
HTTP/1.1
Server
54.156.26.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-156-26-12.compute-1.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

Content-Length
70
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date
Wed, 13 Nov 2024 15:14:35 GMT
Content-Type
image/gif

Redirect headers

cache-control
no-cache, no-store, must-revalidate
location
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
pragma
no-cache
via
1.1 google
expires
0,Thu, 14 Nov 2024 15:14:35 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
content-length
43
date
Wed, 13 Nov 2024 15:14:35 GMT
content-type
image/gif
x-cloud-trace-context
dde04219c43e06751eeb7f59ab504d60
server
Google Frontend
/
px.ads.linkedin.com/wa/
0
232 B
XHR
General
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
*
Content-Type
text/plain;charset=UTF-8

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 17CC11D2F33B4A88BB4598F3C0A2A888 Ref B: MIAEDGE1314 Ref C: 2024-11-13T15:14:34Z
x-li-fabric
prod-ltx1
access-control-allow-credentials
true
x-li-uuid
AAYmzMqfPBihDVLNttKuYA==
x-li-proto
http/2
access-control-allow-origin
https://www.fortinet.com
x-cache
CONFIG_NOCACHE
date
Wed, 13 Nov 2024 15:14:34 GMT
vary
Origin
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=30ffca77-8036-428a-8088-af95c12fe50d&session=acfab952-1775-4d90-874f-268f5cf0e5c6&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A34%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%224018%22%7D&isIframe=false&m=%7B%22description%22%3A%22See%20how%20threat%20actors%20have%20abused%20Remcos%20to%20collect%20sensitive%20information%20from%20victims%20and%20remotely%20control%20their%20computers%20to%20perform%20further%20malicious%20acts.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Crat%22%2C%22title%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pageViewId=8b4f0ce7-6864-4bf1-8a01-a83317d35573&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.29
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"60bb2e15-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 15:14:35 GMT
accept-ranges
bytes
content-length
43
date
Wed, 13 Nov 2024 15:14:35 GMT
content-type
image/gif
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
st
px.mountain.com/
2 KB
1 KB
Script
General
Full URL
https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4&ga_client_id=212376315.1731510872&shpt=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221731510871%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%22%2C%22ga_client_id%22%3A%22212376315.1731510872%22%2C%22shpt%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221731510871.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22kciFDVKZJ%2FDBOXNf82Xv7%2B0IyHBeA9ya%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1731510871.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221731510871%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cb=92537636318304260term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cmediamath%3Dtrue%2Cga4%3Dtrue%2Cappnexus%3Dtrue
Requested by
Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cb=92537636318304260term=value
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.89.99.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-89-99-220.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
934798f2d4cb920f8a372e7fd2967254ce25a5513c6cd6e04e79c0d58d736700

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

transfer-encoding
chunked
content-encoding
gzip
x-envoy-upstream-service-time
1
connection
close
access-control-allow-origin
*
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date
Wed, 13 Nov 2024 15:14:36 GMT
content-type
application/javascript;charset=utf-8
server
istio-envoy
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=30ffca77-8036-428a-8088-af95c12fe50d&session=acfab952-1775-4d90-874f-268f5cf0e5c6&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A35%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225019%22%7D&isIframe=false&m=%7B%22description%22%3A%22See%20how%20threat%20actors%20have%20abused%20Remcos%20to%20collect%20sensitive%20information%20from%20victims%20and%20remotely%20control%20their%20computers%20to%20perform%20further%20malicious%20acts.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Crat%22%2C%22title%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pageViewId=8b4f0ce7-6864-4bf1-8a01-a83317d35573&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.29
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"5e502810-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 15:14:36 GMT
accept-ranges
bytes
content-length
43
date
Wed, 13 Nov 2024 15:14:36 GMT
content-type
image/gif
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
gs
gs.mountain.com/
144 B
733 B
Script
General
Full URL
https://gs.mountain.com/gs
Requested by
Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4&ga_client_id=212376315.1731510872&shpt=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221731510871%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%22%2C%22ga_client_id%22%3A%22212376315.1731510872%22%2C%22shpt%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221731510871.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22kciFDVKZJ%2FDBOXNf82Xv7%2B0IyHBeA9ya%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1731510871.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221731510871%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cb=92537636318304260term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cmediamath%3Dtrue%2Cga4%3Dtrue%2Cappnexus%3Dtrue
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.81.162.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-81-162-201.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
01aac127c979ff3362907e681c7b0f78f615e297f48290d1ad3297200dd74c26

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
public, max-age=31536000
x-envoy-upstream-service-time
1
connection
close
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
x-application-context
application:prod:8080
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date
Wed, 13 Nov 2024 15:14:36 GMT
content-length
144
content-type
application/javascript;charset=utf-8
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
istio-envoy
access-control-allow-headers
Accept, Content-Type, x-requested-with, X-Custom-Header
st
px.mountain.com/
6 KB
2 KB
Script
General
Full URL
https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4&ga_client_id=212376315.1731510872&shpt=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221731510871%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%22%2C%22ga_client_id%22%3A%22212376315.1731510872%22%2C%22shpt%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221731510871.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22kciFDVKZJ%2FDBOXNf82Xv7%2B0IyHBeA9ya%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1731510871.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221731510871%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cmediamath%3Dtrue%2Cga4%3Dtrue%2Cappnexus%3Dtrue&cb=1731510876271948&shguid=32e360b9-c772-34f5-8553-ceb6f1645d3b&shgts=1731510876761
Requested by
Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4&ga_client_id=212376315.1731510872&shpt=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221731510871%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%22%2C%22ga_client_id%22%3A%22212376315.1731510872%22%2C%22shpt%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221731510871.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22kciFDVKZJ%2FDBOXNf82Xv7%2B0IyHBeA9ya%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1731510871.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221731510871%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&cb=92537636318304260term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cmediamath%3Dtrue%2Cga4%3Dtrue%2Cappnexus%3Dtrue
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.89.99.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-89-99-220.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
e118700d70bcc4d5adb1c390975bff1c87c975f45d985aeddca92de7bd7b4dfb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

transfer-encoding
chunked
content-encoding
gzip
x-envoy-upstream-service-time
16
connection
close
access-control-allow-origin
*
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date
Wed, 13 Nov 2024 15:14:37 GMT
content-type
application/javascript;charset=utf-8
server
istio-envoy
tdsync
px.steelhousemedia.com/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=fe8db057-a1d1-11ef-b156-69aed426a8d9&gdpr=&gdpr_consent=
  • https://px.steelhousemedia.com/tdsync?tdid=89de1bef-d89c-48c0-b134-0fb937641c1c&shguid=fe8db057-a1d1-11ef-b156-69aed426a8d9
0
319 B
Image
General
Full URL
https://px.steelhousemedia.com/tdsync?tdid=89de1bef-d89c-48c0-b134-0fb937641c1c&shguid=fe8db057-a1d1-11ef-b156-69aed426a8d9
Protocol
HTTP/1.1
Server
54.244.159.189 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-244-159-189.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time
55
connection
close
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
content-length
0
date
Wed, 13 Nov 2024 15:14:37 GMT
server
istio-envoy
access-control-allow-headers
Accept, Content-Type, x-requested-with, X-Custom-Header

Redirect headers

location
https://px.steelhousemedia.com/tdsync?tdid=89de1bef-d89c-48c0-b134-0fb937641c1c&shguid=fe8db057-a1d1-11ef-b156-69aed426a8d9
content-length
277
date
Wed, 13 Nov 2024 15:14:37 GMT
server
Kestrel
generic
match.adsrvr.org/track/cmf/
Redirect Chain
  • https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=89de1bef-d89c-48c0-b134-0fb937641c1c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ODlkZTFiZWYtZDg5Yy00OGMwLWIxMzQtMGZiOTM3NjQxYzFj&gdpr=0&gdpr_consent=&ttd_tdid=89de1bef-d89c-48c0-b134-0fb93...
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=89de1bef-d89c-48c0-b134-0fb937641c1c&google_gid=CAESEDwuRULoW_H2D9fo8hQYkIc&google_cver=1
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=89de1bef-d89c-48c0-b134-0fb937641c1c
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=6659824704771999787&ttd_tdid=89de1bef-d89c-48c0-b134-0fb937641c1c
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=89de1bef-d89c-48c0-b134-0fb937641c1c&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=89de1bef-d89c-48c0-b134-0fb937641c1c&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D8a111da6-2dc6-437e-99b4-36e0f5eb98ed%252Chttps%2525...
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=6659824704771999787&pt=8a111da6-2dc6-437e-99b4-36e0f5eb98ed%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%...
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
70 B
498 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
Protocol
H2
Server
15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

content-length
70
date
Wed, 13 Nov 2024 15:14:38 GMT
content-type
image/gif
server
Kestrel

Redirect headers

strict-transport-security
max-age=31536000
location
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
0
date
Wed, 13 Nov 2024 15:14:38 GMT
server
Jetty(11.0.13)
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=30ffca77-8036-428a-8088-af95c12fe50d&session=acfab952-1775-4d90-874f-268f5cf0e5c6&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A36%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%226019%22%7D&isIframe=false&m=%7B%22description%22%3A%22See%20how%20threat%20actors%20have%20abused%20Remcos%20to%20collect%20sensitive%20information%20from%20victims%20and%20remotely%20control%20their%20computers%20to%20perform%20further%20malicious%20acts.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Crat%22%2C%22title%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pageViewId=8b4f0ce7-6864-4bf1-8a01-a83317d35573&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.29
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"63f02dad-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 15:14:37 GMT
accept-ranges
bytes
content-length
43
date
Wed, 13 Nov 2024 15:14:37 GMT
content-type
image/gif
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=30ffca77-8036-428a-8088-af95c12fe50d&session=acfab952-1775-4d90-874f-268f5cf0e5c6&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A38%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2013%20Nov%202024%2015%3A14%3A37%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227020%22%7D&isIframe=false&m=%7B%22description%22%3A%22See%20how%20threat%20actors%20have%20abused%20Remcos%20to%20collect%20sensitive%20information%20from%20victims%20and%20remotely%20control%20their%20computers%20to%20perform%20further%20malicious%20acts.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Crat%22%2C%22title%22%3A%22New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&pageViewId=8b4f0ce7-6864-4bf1-8a01-a83317d35573&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.29
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.196.3.199 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-196-3-199.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.fortinet.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"615ccf10-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 15:14:38 GMT
accept-ranges
bytes
content-length
43
date
Wed, 13 Nov 2024 15:14:38 GMT
content-type
image/gif
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
tracking.contanuity.com
URL
https://tracking.contanuity.com/usersync?bwcookie=AAJRv07OaYUAABZ936JzlA

Verdicts & Comments Add Verdict or Comment

162 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 function| OptanonWrapper object| OtTrustedType object| fortinet_blog object| EasyAutocomplete object| search_config boolean| blogFilter string| documentsQuery function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| setImmediate function| clearImmediate function| $ function| jQuery string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| Optanon object| OneTrust function| e object| visitor object| adobe function| Visitor object| s_c_il number| s_c_in object| __target_telemetry object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate object| _satellite boolean| __satelliteLoaded number| timer_e object| _6si function| obApi object| uetq function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq boolean| CE_USER_SCRIPT object| CE2 string| CE_USER_SITE_DATA_URL string| CE_USER_DATA_URL function| UET function| UET_init function| UET_push object| ueto_9f5c2789df string| CE_USER_COMMON_SCRIPT_URL string| CE_USER_THIRDPARTY_SCRIPT_URL object| sifi_att_42656 function| apiObj object| webpackChunkCE2 object| CE2BH function| CE_URL_FINGERPRINT object| CE_API boolean| _storagePopulated object| google_tag_manager object| google_tag_data function| gtag function| onYouTubeIframeAPIReady object| gaGlobal object| targetGlobalSettings object| s_i_fortinetincproduction object| webpackChunkom_api_js object| _omapp function| OptinMonsterApp boolean| om_loaded object| om45602_39852 object| _omq function| omq object| techtargetic function| appendScriptTag string| currentWebsiteUrl string| link object| TAG_INFO string| wid_baseUrl object| wid_cmds object| cookieScriptWindow object| cookieScripts string| cookieScriptDomain boolean| cookieScriptShowBadge string| cookieScriptCurrentUrl string| pagePath string| ftntCampaign function| updateCampaignCookie function| ftntInjectCookieScript function| ftntCookieScriptCreateCookie function| ftntCookieScriptReadCookie object| FingerprintJS string| WID_VISITOR_ID string| WID_EVENT_TYPES string| WID_PAGE_TITLE string| WID_PAGE_URL number| WID_INTERVAL number| WID_IDLE_INTERVAL function| addListenerMulti function| wid_initAgain function| wid_handleAnchorClick function| wid_bundleParams function| wid_handleApiRequest function| wid_fallBackApiRequest function| wid_handleButtonClick function| wid_findParentByTagName function| wid_getCurrentUnixTimestamp function| wid_getCookie function| wid_setCookie function| wid_deleteCookie function| wid_generateRandomGuid function| wid_zeroFill function| wid_str_pad function| wid_rand object| t object| td function| twq string| _linkedin_data_partner_id string| _linkedin_partner_id string| _linkedin_partner_id_2 string| _linkedin_partner_id_3 object| _linkedin_data_partner_ids function| saq function| _saq object| regeneratorRuntime object| twttr string| dcm_cid function| lintrk boolean| _already_called_lintrk string| axel number| a function| fbq function| _fbq object| res object| saCookies string| current_window_url_param object| _sz object| _ml object| Sixsct object| xhr object| ORIBILI string| avail_ga_sorted object| irongate object| mntn

123 Cookies

Domain/Path Name / Value
www.fortinet.com/ Name: cookiesession1
Value: 678A3E5A2D2CC0A33B01F42FA79E94CE
.fortinet.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Wed+Nov+13+2024+05%3A14%3A30+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=6.10.0&hosts=&consentId=0025a943-89f3-467d-9f34-bcf0738741a9&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.fortinet.com/ Name: at_check
Value: true
.demdex.net/ Name: demdex
Value: 63294759403938320303313056908800215410
.fortinet.com/ Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg
Value: 1
.fortinet.com/ Name: mbox
Value: session#af0b4cb3d4d04cbdaab59c3d5af48858#1731512731|PC#af0b4cb3d4d04cbdaab59c3d5af48858.34_0#1794755671
.fortinet.com/ Name: mboxEdgeCluster
Value: 34
.dpm.demdex.net/ Name: dpm
Value: 63294759403938320303313056908800215410
.fortinet.com/ Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg
Value: 179643557%7CMCIDTS%7C20041%7CMCMID%7C62917956448380804703277624010444302586%7CMCAAMLH-1732115670%7C7%7CMCAAMB-1732115670%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1731518070s%7CNONE%7CMCSYNCSOP%7C411-20048%7CvVersion%7C5.5.0
.simpli.fi/ Name: suid
Value: EBC60905896D45418C0F1FB7F86AC98D
.fortinet.com/ Name: _uetsid
Value: fb8c1a90a1d111efb26f8d2ecfe328db
.fortinet.com/ Name: _uetvid
Value: fb8c4db0a1d111efbd18adc039b12f14
www.fortinet.com/ Name: _gd_visitor
Value: 30ffca77-8036-428a-8088-af95c12fe50d
www.fortinet.com/ Name: _gd_session
Value: acfab952-1775-4d90-874f-268f5cf0e5c6
.bing.com/ Name: MUID
Value: 29E27E478A2B611F3A696B718B9560B1
.bat.bing.com/ Name: MR
Value: 0
.fortinet.com/ Name: cebs
Value: 1
www.fortinet.com/ Name: dicbo_id
Value: %7B%22dicbo_fetch%22%3A1731510871533%7D
.fortinet.com/ Name: _ga_38BQ9XFDT4
Value: GS1.1.1731510871.1.0.1731510871.0.0.0
.fortinet.com/ Name: _ga
Value: GA1.1.212376315.1731510872
.fortinet.com/ Name: _ce.clock_data
Value: 42%2C38.132.118.70%2C1%2Ce70c069864ec1ceef7523c2cc9b41fcd%2CChrome%2CUS
.fortinet.com/ Name: cebsp_
Value: 1
.fortinet.com/ Name: _ce.s
Value: v~2d2081be05c2ec8b73d69da8123a097be32f716d~lcw~1731510871737~vir~new~lva~1731510871376~vpv~0~v11.cs~424000~v11.s~fbd96560-a1d1-11ef-9ec6-cf4b5cd94f2d~lcw~1731510871738
.fortinet.com/ Name: gpv_pn
Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims
.fortinet.com/ Name: s_getNewRepeat
Value: 1731510871889-New
.fortinet.com/ Name: s_cc
Value: true
www.fortinet.com/ Name: _omappvp
Value: wWPOVmKlmFgJWy1kgoDQ7EKBd8ZN02jdbs5mDOyHbyI74D2STQVCS5yqwMH28TrkOzi8qkLXlAxox3JMTIvEbKLF9nRDjHZa
www.fortinet.com/ Name: _omappvs
Value: 1731510871932
.techtarget.com/ Name: __cf_bm
Value: PWzaeVo8Azqn3zE7nK6EqqPzQZYSzIL_teNx1i0qr18-1731510872-1.0.1.1-Zg3S73BmodGbXope2XrMnUSXG88NpwkmVM1ymVcQsgBSYBXVnwSoLZQA_qMYQhXvuDrFz5ahoiS1c9jYaJ_7jg
abm-tracking.demandscience.com/ Name: userId
Value: 0ac9c017dfdd772893a32ead8dfce3c5_1731510872543
tracking.contanuity.com/ Name: userId
Value: 0ac9c017dfdd772893a32ead8dfce3c5_1731510872543
tracking.contanuity.com/ Name: clientId
Value: undefined
.www.fortinet.com/ Name: WID_VISITOR_ID
Value: 1731510873640535871
.bidr.io/ Name: bito
Value: AAJRv07OaYUAABZ936JzlA
.bidr.io/ Name: bitoIsSecure
Value: ok
.simpli.fi/ Name: uid_syncd_secure
Value: true
www.fortinet.com/ Name: AWSALB
Value: llfR217crN20u7O9khbFaP7UCV0TAe7uARISsW1EIgdzqmJ8smbsMKnbyvaT6D7dUcT+SiOCIcu6bPSZE60Zicpp8+u0ldDI/FwXlrm5DwG4MzS7EUM+cZ5S3F3ZmAXFrAG1fs4IiQFxv2gkOCfJStAj0JGzdIn35NFPeNpAhBlMFA74thYVuS80TfJrxoFwDfToDf2r1sga54A+EcJf3rvyMnLkbJ+x
www.fortinet.com/ Name: AWSALBCORS
Value: oaTWOtD7+/Q75xrZtyUMojN45jXd3r82OLVBccfaq0CB5HZ+UX+VSGGhwl6MYHi4+h6zfYSvEeYOLt9JlhdgLFlmw8neJOh4kBh3ym4XY5A2Sr6qsVg+k6A0tmdrabY5MRLbQKGWj1Qq+irfssO4spnp00W5ns8F/RqiRCYKYYrXOcPrIwVBFje80dpkDF9wY0SrwSZWT5UKyykvSXxPB8OcD/XJ3hNX
.doubleclick.net/ Name: IDE
Value: AHWqTUm2Xb8UBbQFkDaCp0EIoEJ6n1hDaFLA9RfJiUAvXRFhJXNNj9zC5U0gxq-V_BQ
.tapad.com/ Name: TapAd_TS
Value: 1731510873886
.tapad.com/ Name: TapAd_DID
Value: 8a111da6-2dc6-437e-99b4-36e0f5eb98ed
.3lift.com/ Name: tluidp
Value: 2804009363028051928517
.3lift.com/ Name: tluid
Value: 2804009363028051928517
.agkn.com/ Name: ab
Value: 0001%3Ag%2BQzJ03ms2SlJQPnflI%2F2x7CYnvv8Ztg
.smaato.net/ Name: SCM
Value: b1d8034279
.smaato.net/ Name: SCMs
Value: b1d8034279
.smaato.net/ Name: SCM1001136
Value: b1d8034279
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-2c2df343-078c-5f5c-5e20-760050e08db7.snsH4E%2FAyqmh%2Bl%2Fo2o%2BobQpFCzY%2BZeNI9SaOvxJMKIo
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-2c2df343-078c-5f5c-5e20-760050e08db7.snsH4E%2FAyqmh%2Bl%2Fo2o%2BobQpFCzY%2BZeNI9SaOvxJMKIo
tags.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3ALC3zQweMX1xeIHYAUOCNtyaEdkY.GdEPQUkp2agv5EyFIeXKJWSmX2GpxrT%2BQxumnRcGG50
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3ALC3zQweMX1xeIHYAUOCNtyaEdkY.GdEPQUkp2agv5EyFIeXKJWSmX2GpxrT%2BQxumnRcGG50
tags.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIAPUedzHQELGu9dQtoE8inZnRYgwfzgcKmWRYGWBTArwENYBGAQg2YTTuQYwAToEQiu0oEIEgtiAFw.waye9oDPz5mzFqyMxnbsZhbBOAc7hjXX3PjkhzuH%2BCU
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIAPUedzHQELGu9dQtoE8inZnRYgwfzgcKmWRYGWBTArwENYBGAQg2YTTuQYwAToEQiu0oEIEgtiAFw.waye9oDPz5mzFqyMxnbsZhbBOAc7hjXX3PjkhzuH%2BCU
.openx.net/ Name: i
Value: afeb913c-856f-430c-8694-c2ba5c2a1d2d|1731510874
.rlcdn.com/ Name: rlas3
Value: rXkTqlTD+uKXe4HSmM8EcjMuYZDrxMtIaB+X6dZh604=
.pubmatic.com/ Name: KRTBCOOKIE_148
Value: 19421-uid:EBC60905896D45418C0F1FB7F86AC98D&KRTB&23486-uid:EBC60905896D45418C0F1FB7F86AC98D&KRTB&23489-uid:EBC60905896D45418C0F1FB7F86AC98D&KRTB&23539-uid:EBC60905896D45418C0F1FB7F86AC98D
.pubmatic.com/ Name: PugT
Value: 1731510872
.intentiq.com/ Name: IQver
Value: 1.9
.intentiq.com/ Name: intentIQ
Value: KRUk79Xjqm
.rubiconproject.com/ Name: khaos
Value: M3G0V92V-15-68QI
.rubiconproject.com/ Name: khaos_p
Value: M3G0V92V-15-68QI
.rubiconproject.com/ Name: receive-cookie-deprecation
Value: 1
.lijit.com/ Name: ljt_reader
Value: JqRSAQZHfSy7mOEPRPipRnAW
www.fortinet.com/ Name: sa-user-id
Value: s%253A0-2c2df343-078c-5f5c-5e20-760050e08db7.snsH4E%252FAyqmh%252Bl%252Fo2o%252BobQpFCzY%252BZeNI9SaOvxJMKIo
www.fortinet.com/ Name: sa-user-id-v2
Value: s%253ALC3zQweMX1xeIHYAUOCNtyaEdkY.GdEPQUkp2agv5EyFIeXKJWSmX2GpxrT%252BQxumnRcGG50
www.fortinet.com/ Name: sa-user-id-v3
Value: s%253AAQAKIAPUedzHQELGu9dQtoE8inZnRYgwfzgcKmWRYGWBTArwENYBGAQg2YTTuQYwAToEQiu0oEIEgtiAFw.waye9oDPz5mzFqyMxnbsZhbBOAc7hjXX3PjkhzuH%252BCU
.adnxs.com/ Name: receive-cookie-deprecation
Value: 1
.exelator.com/ Name: EE
Value: "4f0806055af1044cd664f93df4c47d4d"
.yahoo.com/ Name: A3
Value: d=AQABBFrCNGcCEIo8quLZKkf7SoQD8j9Gp-MFEgEBAQETNmc-Z9ww0iMA_eMAAA&S=AQAAAqWaAu5rhOJO4grzY-juBhw
.intentiq.com/ Name: intentIQCDate
Value: 1731510874094
.intentiq.com/ Name: CSDT
Value: UEQ6MTAwNDNfMCZVVTFMQVZU
.intentiq.com/ Name: IQPData
Value: 796931079#1731510874094#0#1731510874094
.intentiq.com/ Name: ASDT
Value: 0
.bfmio.com/ Name: __141_cid
Value: EBC60905896D45418C0F1FB7F86AC98D
.bfmio.com/ Name: __io_cid
Value: 4edfd3296531ec534c6b5b54927a9b75cd9f099a
.lijit.com/ Name: _ljtrtb_2
Value: EBC60905896D45418C0F1FB7F86AC98D
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.crwdcntrl.net/ Name: _cc_id
Value: f40af24732c60ac05608746a1337c38f
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQcEkzcDCwMzA1DQxzdDAxCQ5xczMJM3SOCXNJNnEPMUkZXFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDYYEl%252BUWb6otDgxUUpaQyLSopPBZ%252BczAMAjNop6w%253D%253D"
.twitter.com/ Name: personalization_id
Value: "v1_Kj7QO4UEhSbCYCt+jNo6LQ=="
.pro-market.net/ Name: anHistory
Value: "-xpxaiexg2zhm+2+!#7')%V!^x-"
.ads.stickyadstv.com/ Name: UID
Value: 2e7c5f60d41ba9e6f7e8e795b6de47c8
.ads.stickyadstv.com/ Name: uid-bp-26865
Value: EBC60905896D45418C0F1FB7F86AC98D
.adnxs.com/ Name: anj
Value: dTM7k!M4/8CxrEQF']wIg2GUbJ7p4M!@wnf-Te9(>wL5L!!'Dd$bu'L
.sharethrough.com/ Name: stx_user_id
Value: 742688e8-aea5-4693-888f-4555f146295b
.agkn.com/ Name: u
Value: C|0AAAAAAAALsd-2gAAAAAA
.t.co/ Name: muc_ads
Value: 08241284-192e-41e1-bcd4-efce6dd82004
.t.co/ Name: __cf_bm
Value: xzOz9y6CdjecK8lShfmd.KbKrEB_Kt4HRv0pgN5kbkI-1731510874-1.0.1.1-bmtkMH0GpxIYAgZvuD3hx_Xn.H.OkSQZUvUIyXsFu8Bef5olMxfiiqjBETsZ6iM4xmHXwoltvfCCJ21W_ydYuA
.pippio.com/ Name: did
Value: KkjbBoOJdQLGRBkb
.pippio.com/ Name: didts
Value: 1731510874
.pippio.com/ Name: nnls
Value:
.pippio.com/ Name: pxrc
Value: CNqE07kGEgYIgr0rEAA=
.adnxs.com/ Name: XANDR_PANID
Value: 8vH6SgnLUp0g4RkuPKbzn8yZkJ86WQe7c3uf6UVed92oAeY8MX_OsNVngUyePLc0Ag04_Pii6lL_OnEPLjexqKx3WN-aJyKxv1KsO_OWW3E.
.adnxs.com/ Name: uuid2
Value: 6659824704771999787
www.fortinet.com/ Name: aa_cc
Value: US
www.fortinet.com/ Name: aa_cn
Value: United%20States
www.fortinet.com/ Name: 6scexist
Value: true
.linkedin.com/ Name: lidc
Value: "b=TGST01:s=T:r=T:a=T:p=T:g=3459:u=1:x=1:i=1731510874:t=1731597274:v=2:sig=AQH_doX5_z1l7omx2Lxn9L1skYU1aTu_"
.linkedin.com/ Name: li_sugr
Value: d7045c07-d079-4423-a0c1-28cd7a436cb4
.linkedin.com/ Name: UserMatchHistory
Value: AQJI15h27tr16wAAAZMmFzDxC0xhSP-RvT9gAhactB0vdDlem4yOV_4AXAlnmHh1MZd0Q4tAoktoZQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQK3B_RGitDxsAAAAZMmFzDx3LfP2nTTNPnVFkYIMvs8v2T4L0hSyOr0VH7MkjaGlZY9O46cmCMGvtxLSIxW2Q
.linkedin.com/ Name: bcookie
Value: "v=2&38ccb11a-7ab1-44a7-8147-1fc7ca1c7653"
.fortinet.com/ Name: nmstat
Value: 4e4b04c8-5ff9-e592-fe90-f2415fec1d00
.analytics.yahoo.com/ Name: IDSYNC
Value: "176k~2lt3:19ba~2lt3"
.www.linkedin.com/ Name: bscookie
Value: "v=1&20241113151434c5cce405-e24c-4d6e-8875-cfc3f7db5b49AQFZAwfwp3pwLiIgrUiq89N7EEVb8JR-"
.fortinet.com/ Name: _fbp
Value: fb.1.1731510874520.984169028892615523
.doubleclick.net/ Name: receive-cookie-deprecation
Value: 1
.pro-market.net/ Name: anProfile
Value: "-xpxaiexg2zhm+1+1f=1+1g=1+1j=57:1+rs=s+rt=200105501D0500010000000000000013+s2=(smwaca)+vm=24-EBC60905896D45418C0F1FB7F86AC98D:81-y-txtbMrdE2pTZ9W5Me5vq2bLhmOZjy.k1FVQ-%7EA"
.ml314.com/ Name: pi
Value: 3648398751723683879
.ml314.com/ Name: tp
Value: 4%253B11%252F13%252F2024%2B15%253A14%253A34
.rlcdn.com/ Name: pxrc
Value: CNqE07kGEgUI6AcQABIFCOhHEAASBQjbThAA
.doubleclick.net/ Name: ar_debug
Value: 1
.adsrvr.org/ Name: TDID
Value: 89de1bef-d89c-48c0-b134-0fb937641c1c
.eyeota.net/ Name: mako_uid
Value: 193261732f0-10f30000010a58ab
.eyeota.net/ Name: SERVERID
Value: 22699~DM
.ml314.com/ Name: u
Value: aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLw%3D%3D
.mountain.com/ Name: guid
Value: fe8db057-a1d1-11ef-b156-69aed426a8d9
.px.mountain.com/ Name: tt
Value: "H4sIAAAAAAAAAKtW8guKNzYyNjaLNzK3NFayMtBRgnItjC2UrAzNjQ1NDQ0szM0NDU11lMqUrIx0kLSA1RjUAgBE0YrwRgAAAA=="
.mountain.com/ Name: rt
Value: "MzIzMzY6MTczMTUxMDg3Nw=="
.rubiconproject.com/ Name: audit_p
Value: 1|/DEz2DSgqZN9FGgLxJplvQIcXchOw6Hlk6mizpYhXwybz16xSA9sXaKy3cK5Q8WBfI0OXFY8urSM1KxoLazIt04KBbjzRD/Y5dDZuxGLGk8vN9+MzWxCjGL5/N1bWI2CxG48xoM/Cyi8jPHtuSTHFkybkLVTXmw8SpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.rubiconproject.com/ Name: audit
Value: 1|/DEz2DSgqZN9FGgLxJplvQIcXchOw6Hlk6mizpYhXwybz16xSA9sXaKy3cK5Q8WBfI0OXFY8urSM1KxoLazIt04KBbjzRD/Y5dDZuxGLGk8vN9+MzWxCjGL5/N1bWI2CxG48xoM/Cyi8jPHtuSTHFkybkLVTXmw8SpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value: 2!7647
.adsrvr.org/ Name: TDCPM
Value: CAESFgoHZDB0cm8xahILCKzQqaP9_8E9EAUSEgoDYWFtEgsImPSg2sPNtj0QBRIVCgZnb29nbGUSCwiUncu8_f_BPRAFEhcKCGFwcG5leHVzEgsIoJb_vf3_wT0QBRIWCgdydWJpY29uEgsIhLv_vf3_wT0QBRIUCgV0YXBhZBILCKKGkb_9_8E9EAUYBTgBQgQiAggB

7 Console Messages

Source Level URL
Text
rendering warning URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0B09D0C8C200000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering warning URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A02023118C200000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network error URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Message:
Failed to load resource: the server responded with a status of 401 ()
rendering warning URL: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0B09E0C8C200000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network error URL: https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1731510873640535871&event_type=page_request&timestamp=1731510873&page_title=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&page_url_referer=
Message:
Failed to load resource: the server responded with a status of 401 ()
network error URL: https://stags.bluekai.com/site/29931?id=EBC60905896D45418C0F1FB7F86AC98D
Message:
Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network error URL: https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1731510873640535871&event_type=page_request&timestamp=1731510874&page_title=New%20Campaign%20Uses%20Remcos%20RAT%20to%20Exploit%20Victims%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-campaign-uses-remcos-rat-to-exploit-victims&page_url_referer=
Message:
Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
6033413.global.siteimproveanalytics.io
a.omappapi.com
a.opmnstr.com
aa.agkn.com
abm-tracking.demandscience.com
ads.stickyadstv.com
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
b.6sc.co
bat.bing.com
bcp.crwdcntrl.net
c.6sc.co
cdn.cookielaw.org
cdn.jsdelivr.net
ce.lijit.com
cm.everesttech.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
connect.facebook.net
d.agkn.com
dpm.demdex.net
dx.mountain.com
eb2.3lift.com
eps.6sc.co
fei.pro-market.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
i.simpli.fi
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
image2.pubmatic.com
insight.adsrvr.org
intentstream.contanuity.com
ipv6.6sc.co
j.6sc.co
loadm.exelator.com
match.adsrvr.org
match.sharethrough.com
metrics.fortinet.com
ml314.com
pbid.pro-market.net
pippio.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
pixels.argusplatform.com
ps.eyeota.net
px.ads.linkedin.com
px.mountain.com
px.steelhousemedia.com
px4.ads.linkedin.com
s.ad.smaato.net
script.crazyegg.com
secure.adnxs.com
simplifi.partners.tremorhub.com
siteimproveanalytics.com
snap.licdn.com
stags.bluekai.com
static.ads-twitter.com
sync.1rx.io
sync.bfmio.com
sync.intentiq.com
t.co
tag.simpli.fi
tags.inzynk.io
tags.srv.stackadapt.com
tmp.argusplatform.com
tr.outbrain.com
tracking.contanuity.com
tracking.crazyegg.com
trk.techtarget.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
wave.outbrain.com
webtracker.argusplatform.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
tracking.contanuity.com
104.19.148.8
104.244.42.67
107.178.254.65
108.138.128.14
13.107.42.14
142.250.65.226
142.251.35.162
142.251.40.100
142.251.41.6
15.197.193.217
151.101.44.157
172.217.165.130
172.66.0.227
172.67.163.237
2001:4998:1c:800::1000
216.200.232.253
23.196.3.199
23.197.253.128
23.199.37.208
23.51.57.192
2600:141b:1c00:2080::1e80
2600:141b:1c00:2e::17d1:48d1
2600:141b:b000::173b:fbd3
2600:1901:0:8eee::
2600:1f18:1492:1701:a964:c08d:f5eb:b0c
2600:1f18:612b:4216:8b4:d7c1:7102:1a81
2600:9000:2073:6600:1b:6b7d:2300:93a1
2600:9000:21f9:3c00:19:fc2c:a140:93a1
2600:9000:21f9:6600:12:dfa9:e200:93a1
2600:9000:2840:7400:1b:5138:8a40:93a1
2606:4700:3108::ac42:2af8
2606:4700:4400::6812:2089
2606:4700::6812:1347
2606:4700::6812:572a
2607:f8b0:4006:80f::2008
2607:f8b0:4006:816::200e
2620:1ec:21::14
2620:1ec:29:1::40
2620:1ec:33:1::10
2a02:6ea0:c454::1
2a03:2880:f112:83:face:b00c:0:25de
2a04:4e42::485
3.13.136.49
31.13.71.7
34.111.113.62
34.111.208.231
34.117.77.79
34.150.170.96
34.197.160.137
34.204.233.191
35.175.35.80
35.244.154.8
35.244.159.8
35.245.15.98
35.71.139.29
35.81.162.201
44.208.126.163
44.209.137.118
44.226.187.177
52.0.156.250
52.202.124.0
52.22.50.55
52.32.164.86
52.44.251.75
52.70.150.194
52.89.99.220
54.146.68.25
54.156.26.12
54.166.218.157
54.203.236.163
54.244.159.189
63.140.38.112
63.140.39.240
63.251.28.210
64.202.112.159
68.67.179.153
68.67.179.155
69.173.146.5
69.194.240.13
8.28.7.83
99.83.231.3
01aac127c979ff3362907e681c7b0f78f615e297f48290d1ad3297200dd74c26
0a2816206ea0d9b29d21a55ff5a266058db372a3f87696a6a463bdc85cb1a949
0a8b3c914545d7ab159c36e40602b0c360897355b29cd8967fc83cb3e489a2d3
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0cd344605a83e699d26efaf3206c882e108d1197292e2f3b4c327a24ed53e613
0cf246d6cd139b795a60b01f5d66885f3a685b2433222bd698371d429418d5ea
0e558bfe20ca32463b1b3ba7fc2e06dac3850e7f816c5071599d3c150eeb65f1
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
16fb72ffe51980a00e52edf9a001b7d560b2bdbd1a56e04366a70b674204c359
1885fa140df271c97bf904d43f5385b84aa7458ff60cc20dae89ca4e9df959d9
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
1ebf4765c39e042319d8cc3f4070ef97c89b6e18a3f28bcec0bb7e58a9042a8f
210d3777699e981b1087ef862308f1099b508aab100f46aae7eeedc339f030be
21e1e9c369a99c9d0666d9c115a107d9df16a8a44119fd650fee9f52802269bd
23ca5578686d651deed4508b104fe16de675ab296becda560dc17d741f090af1
259bd74127f3150b5dbe1c2f9da49d1dbeeecce06bd0152f333839f448722ae2
25f6404b0bab974a632fc3d8adfe559b6c9e85e2b461f47a915ed2796901f035
2a250e2f225e48cf583d54a0a42d623c700847de17323bf23ea372e5d9e89cb2
2bc3f32248814e53fb0792922dae3d54ebbeb6c7be7d95d20df0e2fa6a69ae67
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
30cdd063281864e41a8e076752bc1ea6e6534d7e7f3b35433a6ac3bf4982ebe4
30e3ee538441256091bfe54048cdb9883bd4509a9e6e4b68827771ddb1cf4207
32b4931413d5ce2afcf4ef52b12d39c3d6dd7247bd73c3a160c734b67c1a4c95
3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
38a4d98e8a644d2a59d5f709452915bec15b125de944590af7fcaeb06b2472ca
3923bff4786ef686d8dd4376b99c73c72b93e302b1dfb68243c7b620c4c27b99
3ae06367235ffbfe4f618e57467802343ea96fa0235b4f953b7c928b1674b702
3cafe408bf18e918d7daac870762a97244d03a73aca8ed7fe6a17141dfe34dad
3d5e2f7e7d7b47abbb9e045643f1f783327593164a1cc826823b86935ea0dc1b
3e75053eb73861e42602ca4075a48ad1a004f507ca9949210cfd09517114cc72
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4874fa9fd13dc1a03d79114835648fcad2a4ea5f9e53a72a19f7a1c2f002de34
4922a8859b315c354c23ad278e35483c6cf29aebf1c509c2c928c1f41634fe43
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
527bf3dacc5eb62211130fe4bf315c682861320ab25b4aa2efe6ea87a760db8c
55096bdb72819db90b109af46d94fce8e71551e9c7a8464a6dcf930f60bb7f39
5607bc0b49036b5f13acf3f5767e0fb2fb947f5369bda253939e78e2b11f85b4
5a44bc40527e09426a4c58aa907fdf72074591ea0bcfee1e8c6b2c7056a9eb91
5a922a2c59c77d6ae5ce67413c452540ffe00b468d240ab6928531bab15fce2b
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5f13d75795dbc9a02d514d38afb282a463efe4698b22c820a040b17c132a6127
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
619a66b171139705014abb66652b93ba67dba872d941be3aa7372ceb08201dbb
62b85cd581a8ec3c3a487aee9542df9b8738fbab7310182ea20820594db0f4a3
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552
6f8ea4bfcb15d37d8476e99bd6f64d88cca6fc000b8fa4cf0e06855a4710096d
71cfd0bf781e3f393bca283fc9d44777a2036985a4ffe9abedf14909e63a8aef
72996417e47cfa9d2e1d6695c304cc0830d33f5350191ab9d092d93738db9b1c
75e1826a8d1cd5059e09ca0c508d8da3228ecf159fd01316ec34eaef57543357
789e8ae2f43db57070e47d9ab0ec5ba687cd2e3525084d152b001cb17e36d03c
7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
7bfb525912849c73e691a90795cb2e3ce02a95afa8b21db37208591610d75849
7c502d550f5fe20eee417decbabf97452005f80d5ffe8933e2b0fe8cbcf33fe9
7c766428dac46814e1fec869d324282ea07cfe306868967aa8a372a3616ed4ed
7d8bd939933062935977eeb7af4d11047164be70e17407be8c754458ae19ba4e
7db8d077fc21c20f1449a2603d524e423cfa25d7df6d5fd845a8e5e883aa227e
81e93e51e78a978d2c4dc717fb236195baba3623fdf924b70513b300914730f6
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
8cbd18186b68edee7ccf8f12acfd296f3752d51cd0ebc04dff271e9d601d744d
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
910ab43f73b6073142379650feb6de6f77744c9a418754fab9e8c71b12065c10
930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6
934798f2d4cb920f8a372e7fd2967254ce25a5513c6cd6e04e79c0d58d736700
94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66
96bd6c16407e51bc964ec45a12633389a3c3b599f225874a86e7cea398526681
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
98487405c7f3625d1f0566a9e58f1dfd35eb5252853f41c33031faccd5c9f0d4
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
9a819eb7f895fba3c35832391cea5a27f7960e6c478513a025283df2f6f21641
9ce9e23b2f0aff01f3a20cde4e99e014e306dfb3c420bee920ea9e0f323a6ccc
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1050b6624dd64bb43f5b8c093c1363ab2fdc3b0698ee486df2e7d897d2c6ef6
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a48d321e1f30c017b6d9407b160c7253ee3dee7e1b28c9f49e57e40c52b4a71e
a5fedaddf8960351b7dcb1bf9b4a2ce58b28a336901d7eebe92b92c9aeb185f8
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ade920fd5b00cd298aae7978673a9a64d0bb3fa593d23e91994ec6b6723ebace
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3b9f816048eba794278ecb39ff263ac3b7bc55c235b1c6c891c42b11f8435b8
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
b5434794dd48d15d9e0a31e0d6b9b64afb739c5835bd1972e84096d1e35f4ed1
b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e
b726aa772c609165b5815643b26bb2e91d5d55d337a1cd073a0b9b943d77e869
b8084072016d0b8e5ad1a96a2bd64333d325d0c3ac55f45112bfaf353743ec59
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bfb50654266cd61ddc1f60811a6f517eddab6abeca093e5369fe0e61dacd32f3
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869
c3b557d8a9405227edbfd04c2f2f199168deceb2806059a02abba860054615a5
c44f719750dd68af8862cbcfa4ab17d67bf462fa44992e5043f073af63c72984
c5e2f3bd6de83dae9307b2eb56380edaef01582a4ca721583ce3c745b15c2388
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86
c93c62ebfd2a7f0e95f77ea558c53c2536ba327c1a28ad4870f2d518476500b6
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
ced16fb84941eb1582822542d082b1911b669ac0c125c3ba47d55e3521a1514c
cf4179f9a669a40a63939143f20729f61b798e084db5124f008170868315281c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d12d6916f244b407ef03c8a770d16da6a3aa60adef4d3ad50c6341c32fe841cc
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d491f197645c391fa5f44c565d359352a3b1e714e8cb0c2e71ed0a21588d45bd
d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60
d4a80838b8edb9ed18d58be8bed24eba466c1d004b4178a47b661c61093a34df
d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af
d742917b312cdf1c37ee321034219943eee051857fbf60833c90e449c43392c9
d8d035718c0398cf5747619ac3ab6841befefe89040395fe94376d50e1599d29
da777cb7cdc9dbdf45de521b6c9bcd8fd370e17db390438f64ea29def6efca82
da7fd15533dece70af68accd0eae75fc46e3ee044da41bdef69215d375af95c5
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0
e118700d70bcc4d5adb1c390975bff1c87c975f45d985aeddca92de7bd7b4dfb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e270584c7610f3031d6db0eeaabb7c4de7f595726d66d2a07844758a9c7b27
ecdf429fda499cefeec5316b2650abe996a2dcf09a16dbd4a4b4aeab971ef550
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2489dc61786cfcc0a7d81d9ef195c9ad53620928e746388f507f59f76cbb258
f57569593403f502d6e83f7ca44d3371a7f6e9b0c409561f69c73f22eb63f700
f90a12e53778185041a29bc37dbdd7d808eda0ac304d0822ba7ede32fd2646c8
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fa0e1d2d5f211be66b90f05a20ac7030c70c0eed9033d5bde29b91a47a8f034c
fba345f22ace7548de35132830525fadbfde71c86c8191fca1b24e6f7dab7eb7
fc0de94620ef9ccacfa68e0c7fef1dd6ad73f7920acd47cc1009713af6f1b703
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a