www.fortinet.com Open in urlscan Pro
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://401.tw/Mr6E
Effective URL:
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Submission: On September 20 via api (September 20th 2024, 1:15:18 pm UTC) from IN — Scanned from JP

Summary HTTP 237 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 74 IPs in 6 countries across 63 domains to perform 237 HTTP transactions. The main IP is 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06, located in Singapore, Singapore and belongs to AMAZON-02, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 115924.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 16th 2024. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.105.230.106 172.105.230.106	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
60	2406:da18:ad1... 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	2600:140b:a00... 2600:140b:a00:383::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 4	13.112.211.211 13.112.211.211	16509 (AMAZON-02) (AMAZON-02)
1	52.197.184.52 52.197.184.52	16509 (AMAZON-02) (AMAZON-02)
1 1	13.250.176.54 13.250.176.54	16509 (AMAZON-02) (AMAZON-02)
2	63.140.50.233 63.140.50.233	16509 (AMAZON-02) (AMAZON-02)
6	104.19.147.8 104.19.147.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	23.50.118.169 23.50.118.169	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.32.225.140 23.32.225.140	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.87.122.136 34.87.122.136	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2404:6800:400... 2404:6800:4004:818::2008	15169 (GOOGLE) (GOOGLE)
2	38.133.127.191 38.133.127.191	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	2600:140b:1c0... 2600:140b:1c00:39::1732:761f	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	13.248.142.121 13.248.142.121	16509 (AMAZON-02) (AMAZON-02)
2	99.83.231.3 99.83.231.3	16509 (AMAZON-02) (AMAZON-02)
4	43.202.117.154 43.202.117.154	16509 (AMAZON-02) (AMAZON-02)
2	13.225.183.12 13.225.183.12	16509 (AMAZON-02) (AMAZON-02)
6	142.251.42.136 142.251.42.136	15169 (GOOGLE) (GOOGLE)
2	2404:6800:400... 2404:6800:4004:823::200e	15169 (GOOGLE) (GOOGLE)
2	2400:52e0:150... 2400:52e0:1501::1193:1	200325 (BUNNYCDN) (BUNNYCDN)
1	2606:4700:310... 2606:4700:3108::ac42:2af8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1347	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.32.164.86 52.32.164.86	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:bdf::46 2620:1ec:bdf::46	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	74.121.140.211 74.121.140.211	30419 (PAEDAE-INC) (PAEDAE-INC)
3	2404:6800:400... 2404:6800:4004:825::2002	15169 (GOOGLE) (GOOGLE)
1 3	172.217.26.230 172.217.26.230	15169 (GOOGLE) (GOOGLE)
1 4	142.251.42.162 142.251.42.162	15169 (GOOGLE) (GOOGLE)
1	172.217.161.34 172.217.161.34	15169 (GOOGLE) (GOOGLE)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 4	142.251.222.36 142.251.222.36	15169 (GOOGLE) (GOOGLE)
4	142.250.76.131 142.250.76.131	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
2	44.226.187.177 44.226.187.177	16509 (AMAZON-02) (AMAZON-02)
1	54.190.217.118 54.190.217.118	16509 (AMAZON-02) (AMAZON-02)
1	151.101.228.157 151.101.228.157	54113 (FASTLY) (FASTLY)
1 2	103.43.90.19 103.43.90.19	29990 (ASN-APPNEX) (ASN-APPNEX)
1 3	103.43.90.117 103.43.90.117	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:275... 2600:9000:2751:3600:12:dfa9:e200:93a1	16509 (AMAZON-02) (AMAZON-02)
3	172.66.0.227 172.66.0.227	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
19 25	34.124.209.251 34.124.209.251	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	2600:9000:27a... 2600:9000:27af:c000:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
3 5	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
9 9	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
2 3	74.118.186.107 74.118.186.107	6336 (TURN-US-ASN) (TURN-US-ASN)
1 2	35.71.178.8 35.71.178.8	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4200:439f:77e3:80bf:81be	14618 (AMAZON-AES) (AMAZON-AES)
1 1	52.68.127.144 52.68.127.144	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:26f... 2600:9000:26f2:1600:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	3.164.110.92 3.164.110.92	16509 (AMAZON-02) (AMAZON-02)
2 2	2600:1901:0:8... 2600:1901:0:8eee::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	23.106.127.57 23.106.127.57	59253 (LEASEWEB-...) (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD.)
1 2	34.229.3.43 34.229.3.43	14618 (AMAZON-AES) (AMAZON-AES)
1	52.23.38.239 52.23.38.239	14618 (AMAZON-AES) (AMAZON-AES)
1 2	23.36.17.70 23.36.17.70	16625 (AKAMAI-AS) (AKAMAI-AS)
3 4	52.74.120.137 52.74.120.137	16509 (AMAZON-02) (AMAZON-02)
1 2	35.82.115.140 35.82.115.140	16509 (AMAZON-02) (AMAZON-02)
2 3	35.244.154.8 35.244.154.8	15169 (GOOGLE) (GOOGLE)
4 4	142.250.196.130 142.250.196.130	15169 (GOOGLE) (GOOGLE)
1 1	142.250.196.98 142.250.196.98	15169 (GOOGLE) (GOOGLE)
1 2	69.173.158.64 69.173.158.64	26667 (RUBICONPR...) (RUBICONPROJECT)
1	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
2	157.240.31.5 157.240.31.5	32934 (FACEBOOK) (FACEBOOK)
1	172.67.163.237 172.67.163.237	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.203.236.163 54.203.236.163	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f10... 2a03:2880:f10f:187:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 5	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:140b:1a0... 2600:140b:1a00:4::17c1:b893	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	54.183.57.53 54.183.57.53	16509 (AMAZON-02) (AMAZON-02)
1	100.20.58.101 100.20.58.101	16509 (AMAZON-02) (AMAZON-02)
3 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2 3	18.182.162.20 18.182.162.20	16509 (AMAZON-02) (AMAZON-02)
2	52.37.218.4 52.37.218.4	16509 (AMAZON-02) (AMAZON-02)
1	52.12.117.226 52.12.117.226	16509 (AMAZON-02) (AMAZON-02)
1	52.10.121.135 52.10.121.135	16509 (AMAZON-02) (AMAZON-02)
1	23.34.169.153 23.34.169.153	16625 (AKAMAI-AS) (AKAMAI-AS)
237	74

1 172.105.230.106 (Tokyo, Japan) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1884-106.members.linode.com

401.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

60 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2600:140b:a00:383::1e80 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.112.211.211 (Tokyo, Japan) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-112-211-211.ap-northeast-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.197.184.52 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-197-184-52.ap-northeast-1.compute.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.250.176.54 (Singapore, Singapore) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-250-176-54.ap-southeast-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.50.233 (United States)

ASN16509 (AMAZON-02, US)

fortinet.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.19.147.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 23.50.118.169 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-50-118-169.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.32.225.140 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-32-225-140.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wave.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.87.122.136 (Singapore, Singapore)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 136.122.87.34.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4004:818::2008 (Australia)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 38.133.127.191 (Sacramento, United States)

ASN22075 (AS-OUTBRAIN, US)

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:1c00:39::1732:761f (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.142.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.231.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 43.202.117.154 (Incheon, Korea, Republic Of)

ASN16509 (AMAZON-02, US)
PTR: ec2-43-202-117-154.ap-northeast-2.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.183.12 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-183-12.nrt57.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.42.136 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s45-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4004:823::200e (Australia)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:52e0:1501::1193:1 (Japan)

ASN200325 (BUNNYCDN, SI)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:2af8 (United States)

ASN13335 (CLOUDFLARENET, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1347 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.32.164.86 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-164-86.us-west-2.compute.amazonaws.com

abm-tracking.demandscience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:bdf::46 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

tmp.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixels.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
webtracker.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.121.140.211 (Reston, United States)

ASN30419 (PAEDAE-INC, US)

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:4004:825::2002 (Australia)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.26.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s51-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
10104846.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.42.162 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s46-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.161.34 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s23-in-f2.1e100.net

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.222.36 (Farmingdale, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt13s72-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.76.131 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: kix07s06-in-f3.1e100.net

www.google.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.226.187.177 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-226-187-177.us-west-2.compute.amazonaws.com

intentstream.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.190.217.118 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-190-217-118.us-west-2.compute.amazonaws.com

dx.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.228.157 (San Francisco, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.43.90.19 (Singapore, Singapore) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.43.90.117 (Singapore, Singapore) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2751:3600:12:dfa9:e200:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.inzynk.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.66.0.227 (United States)

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 34.124.209.251 (Singapore, Singapore) 19 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 251.209.124.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:27af:c000:1b:5138:8a40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.111.113.62 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 15.197.193.217 (Seattle, United States) 9 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 74.118.186.107 (Serangoon New Town, Singapore) 2 redirects

ASN6336 (TURN-US-ASN, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.178.8 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ade9ecc7904667038.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4200:439f:77e3:80bf:81be (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.68.127.144 (Tokyo, Japan) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-68-127-144.ap-northeast-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26f2:1600:19:fc2c:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.164.110.92 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-3-164-110-92.nrt12.r.cloudfront.net

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.106.127.57 (Singapore, Singapore) 1 redirects

ASN59253 (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD., SG)

sync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.229.3.43 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-229-3-43.compute-1.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.23.38.239 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-23-38-239.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.36.17.70 (Tokyo, Japan) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-17-70.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.74.120.137 (Singapore, Singapore) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-74-120-137.ap-southeast-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.82.115.140 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-82-115-140.us-west-2.compute.amazonaws.com

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.154.8 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.196.130 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s36-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.196.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s35-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.158.64 (Singapore, Singapore) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.31.5 (Tokyo, Japan)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-nrt1.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.163.237 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.203.236.163 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-236-163.us-west-2.compute.amazonaws.com

tracking.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f10f:187:face:b00c:0:25de (Tokyo, Japan)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.117.77.79 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:1a00:4::17c1:b893 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.183.57.53 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-183-57-53.us-west-1.compute.amazonaws.com

6033413.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 100.20.58.101 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-100-20-58-101.us-west-2.compute.amazonaws.com

100.20.58.101	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.182.162.20 (Tokyo, Japan) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-182-162-20.ap-northeast-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.37.218.4 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-37-218-4.us-west-2.compute.amazonaws.com

px.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.12.117.226 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-12-117-226.us-west-2.compute.amazonaws.com

gs.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.10.121.135 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-10-121-135.us-west-2.compute.amazonaws.com

px.steelhousemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.34.169.153 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-34-169-153.deploy.static.akamaitechnologies.com

su.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
61	fortinet.com www.fortinet.com — Cisco Umbrella Rank: 115924 metrics.fortinet.com — Cisco Umbrella Rank: 284311	5 MB
27	simpli.fi 19 redirects tag.simpli.fi — Cisco Umbrella Rank: 4944 i.simpli.fi — Cisco Umbrella Rank: 4294 um.simpli.fi — Cisco Umbrella Rank: 934	15 KB
22	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 452	151 KB
20	6sc.co j.6sc.co — Cisco Umbrella Rank: 5691 c.6sc.co — Cisco Umbrella Rank: 7155 ipv6.6sc.co — Cisco Umbrella Rank: 5832 b.6sc.co — Cisco Umbrella Rank: 3516 eps.6sc.co — Cisco Umbrella Rank: 825589 v.eps.6sc.co — Cisco Umbrella Rank: 905132	24 KB
15	doubleclick.net 6 redirects td.doubleclick.net — Cisco Umbrella Rank: 189 ad.doubleclick.net — Cisco Umbrella Rank: 153 googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 cm.g.doubleclick.net — Cisco Umbrella Rank: 284 10104846.fls.doubleclick.net — Cisco Umbrella Rank: 296118	9 KB
10	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2506 tracking.crazyegg.com — Cisco Umbrella Rank: 4420	79 KB
9	adsrvr.org 9 redirects match.adsrvr.org — Cisco Umbrella Rank: 382 insight.adsrvr.org — Cisco Umbrella Rank: 954	7 KB
8	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	726 KB
6	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 327 www.linkedin.com — Cisco Umbrella Rank: 646 px4.ads.linkedin.com — Cisco Umbrella Rank: 6795	4 KB
6	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	127 KB
5	ml314.com 1 redirects ml314.com — Cisco Umbrella Rank: 1751	40 KB
5	tapad.com 3 redirects pixel.tapad.com — Cisco Umbrella Rank: 467	2 KB
5	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 479 ib.adnxs.com — Cisco Umbrella Rank: 270	5 KB
5	outbrain.com amplify.outbrain.com — Cisco Umbrella Rank: 3422 tr.outbrain.com — Cisco Umbrella Rank: 3354 wave.outbrain.com — Cisco Umbrella Rank: 3410	10 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 256 fortinet.demdex.net — Cisco Umbrella Rank: 308668	3 KB
4	crwdcntrl.net 3 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 989 sync.crwdcntrl.net — Cisco Umbrella Rank: 915	1 KB
4	mountain.com dx.mountain.com — Cisco Umbrella Rank: 5047 px.mountain.com — Cisco Umbrella Rank: 5170 gs.mountain.com — Cisco Umbrella Rank: 9611	11 KB
4	google.co.jp www.google.co.jp — Cisco Umbrella Rank: 26138	256 B
4	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 3	216 B
3	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1085	2 KB
3	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 476	627 B
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 932	727 B
3	t.co t.co — Cisco Umbrella Rank: 834	1 KB
3	contanuity.com intentstream.contanuity.com — Cisco Umbrella Rank: 58667 tracking.contanuity.com — Cisco Umbrella Rank: 19503	1 KB
3	argusplatform.com tmp.argusplatform.com — Cisco Umbrella Rank: 299240 pixels.argusplatform.com — Cisco Umbrella Rank: 299605 webtracker.argusplatform.com — Cisco Umbrella Rank: 306518	4 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 28371 ibc-flow.techtarget.com — Cisco Umbrella Rank: 25060	2 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 361	15 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 106	4 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 178	71 KB
2	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 414	3 KB
2	lijit.com 1 redirects ce.lijit.com — Cisco Umbrella Rank: 943	895 B
2	bluekai.com 1 redirects stags.bluekai.com — Cisco Umbrella Rank: 1278 tags.bluekai.com — Cisco Umbrella Rank: 853	767 B
2	exelator.com 1 redirects loadm.exelator.com — Cisco Umbrella Rank: 2052	3 KB
2	smartadserver.com 1 redirects sync.smartadserver.com — Cisco Umbrella Rank: 1446	1 KB
2	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2630	931 B
2	intentiq.com 1 redirects sync.intentiq.com — Cisco Umbrella Rank: 1035	2 KB
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 544 d.agkn.com — Cisco Umbrella Rank: 777	1 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 424	970 B
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 509	730 B
2	demandscience.com abm-tracking.demandscience.com — Cisco Umbrella Rank: 56454	3 KB
2	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 6393 api.omappapi.com — Cisco Umbrella Rank: 6510	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 8883	718 B
1	addthis.com su.addthis.com — Cisco Umbrella Rank: 8827	63 B
1	steelhousemedia.com px.steelhousemedia.com — Cisco Umbrella Rank: 12708	319 B
1	siteimproveanalytics.io 6033413.global.siteimproveanalytics.io — Cisco Umbrella Rank: 257361	149 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 782	14 KB
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3837	12 KB
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 526	264 B
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 91	23 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1589	421 B
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6782	175 B
1	unrulymedia.com sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1217	378 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 676	528 B
1	inzynk.io tags.inzynk.io — Cisco Umbrella Rank: 200853	443 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 875	15 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 314	15 KB
1	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 2662	711 B
1	opmnstr.com a.opmnstr.com — Cisco Umbrella Rank: 33929	18 KB
1	omtrdc.net fortinet.tt.omtrdc.net — Cisco Umbrella Rank: 295805	842 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1463	490 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 491	305 B
1	401.tw 1 redirects 401.tw	297 B
237	63

	Domain	Requested by
60	www.fortinet.com	www.fortinet.com
25	um.simpli.fi	19 redirects
22	assets.adobedtm.com	cdn.cookielaw.org assets.adobedtm.com
13	b.6sc.co	www.fortinet.com
8	match.adsrvr.org	8 redirects
8	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com abm-tracking.demandscience.com
6	script.crazyegg.com	www.fortinet.com script.crazyegg.com
6	cdn.cookielaw.org	www.fortinet.com cdn.cookielaw.org
5	ml314.com	1 redirects www.fortinet.com ml314.com
5	pixel.tapad.com	3 redirects
4	px.ads.linkedin.com	2 redirects snap.licdn.com
4	cm.g.doubleclick.net	4 redirects
4	www.google.co.jp	www.fortinet.com
4	www.google.com	1 redirects www.fortinet.com
4	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
4	td.doubleclick.net	www.googletagmanager.com
4	tracking.crazyegg.com	script.crazyegg.com
4	dpm.demdex.net	1 redirects www.fortinet.com
3	ps.eyeota.net	2 redirects
3	idsync.rlcdn.com	2 redirects
3	analytics.twitter.com
3	t.co
3	ib.adnxs.com	1 redirects
3	bat.bing.com	assets.adobedtm.com bat.bing.com www.fortinet.com
2	px.mountain.com	dx.mountain.com px.mountain.com
2	sync.crwdcntrl.net	2 redirects
2	www.facebook.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	10104846.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	pixel.rubiconproject.com	1 redirects
2	ce.lijit.com	1 redirects
2	bcp.crwdcntrl.net	1 redirects
2	loadm.exelator.com	1 redirects
2	sync.smartadserver.com	1 redirects
2	fei.pro-market.net	2 redirects
2	sync.intentiq.com	1 redirects
2	eb2.3lift.com	1 redirects
2	sync.1rx.io	2 redirects
2	secure.adnxs.com	1 redirects
2	intentstream.contanuity.com	abm-tracking.demandscience.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	abm-tracking.demandscience.com	www.fortinet.com abm-tracking.demandscience.com
2	www.google-analytics.com	www.googletagmanager.com
2	v.eps.6sc.co	j.6sc.co
2	eps.6sc.co	j.6sc.co
2	epsilon.6sense.com	j.6sc.co
2	tr.outbrain.com	amplify.outbrain.com
2	amplify.outbrain.com	www.fortinet.com amplify.outbrain.com
1	su.addthis.com
1	tags.bluekai.com	1 redirects
1	insight.adsrvr.org	1 redirects
1	px.steelhousemedia.com
1	gs.mountain.com	px.mountain.com
1	webtracker.argusplatform.com	tmp.argusplatform.com
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	6033413.global.siteimproveanalytics.io
1	snap.licdn.com	www.fortinet.com
1	tracking.contanuity.com	abm-tracking.demandscience.com
1	siteimproveanalytics.com	assets.adobedtm.com
1	us-u.openx.net
1	www.googleadservices.com	1 redirects
1	stags.bluekai.com
1	sync.bfmio.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.targeting.unrulymedia.com
1	s.ad.smaato.net	1 redirects
1	tags.inzynk.io	assets.adobedtm.com
1	static.ads-twitter.com	www.fortinet.com
1	dx.mountain.com	www.fortinet.com
1	i.simpli.fi	tag.simpli.fi
1	cdn.jsdelivr.net	abm-tracking.demandscience.com
1	pixels.argusplatform.com	tmp.argusplatform.com
1	ad.doubleclick.net	www.fortinet.com
1	pixel.mathtag.com	www.fortinet.com
1	tmp.argusplatform.com	www.fortinet.com
1	trk.techtarget.com	www.fortinet.com
1	api.omappapi.com	a.opmnstr.com
1	a.omappapi.com	a.opmnstr.com
1	a.opmnstr.com	assets.adobedtm.com
1	metrics.fortinet.com	www.fortinet.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	wave.outbrain.com	amplify.outbrain.com
1	tag.simpli.fi	assets.adobedtm.com
1	j.6sc.co	www.fortinet.com
1	fortinet.tt.omtrdc.net	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	www.fortinet.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	401.tw	1 redirects
237	93

This site contains links to these domains. Also see Links.

Domain
github.com
nvd.nist.gov
geoserver.org
www.cisa.gov
www.fortiguard.com
attack.mitre.org
training.fortinet.com
www.linkedin.com
www.twitter.com
www.youtube.com
www.instagram.com
www.facebook.com
fortiguard.com
community.fortinet.com
investor.fortinet.com
onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-16` - `2025-07-15`	a year	crt.sh
cookielaw.org WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
script.crazyegg.com Cloudflare Inc ECC CA-3	`2024-08-02` - `2024-12-31`	5 months	crt.sh
6sc.co R11	`2024-07-03` - `2024-10-01`	3 months	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-14` - `2024-12-14`	a year	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-04-04` - `2025-05-04`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-30` - `2025-09-29`	a year	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-06-21` - `2025-07-20`	a year	crt.sh
metrics.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-26` - `2025-01-25`	a year	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
a.opmnstr.com R10	`2024-08-08` - `2024-11-06`	3 months	crt.sh
a.omappapi.com R10	`2024-08-08` - `2024-11-06`	3 months	crt.sh
omappapi.com WE1	`2024-08-14` - `2024-11-12`	3 months	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
abm-tracking.demandscience.com R10	`2024-08-14` - `2024-11-12`	3 months	crt.sh
tmp.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
*.mathtag.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-04-23` - `2025-04-30`	a year	crt.sh
*.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
ibc-flow.techtarget.com WR3	`2024-08-28` - `2024-11-26`	3 months	crt.sh
pixels.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-08` - `2025-03-08`	6 months	crt.sh
*.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.google.co.jp WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
intentstream.contanuity.com E6	`2024-08-15` - `2024-11-13`	3 months	crt.sh
*.mountain.com Go Daddy Secure Certificate Authority - G2	`2024-05-23` - `2025-06-24`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
*.inzynk.io Amazon RSA 2048 M02	`2024-01-07` - `2025-02-04`	a year	crt.sh
t.co E6	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-02` - `2024-10-31`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-29` - `2024-09-27`	3 months	crt.sh
siteimproveanalytics.com WE1	`2024-08-19` - `2024-11-17`	3 months	crt.sh
tracking.contanuity.com R11	`2024-09-11` - `2024-12-10`	3 months	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-08-21` - `2024-11-19`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.global.r1.siteimproveanalytics.io Amazon RSA 2048 M03	`2024-09-02` - `2025-10-01`	a year	crt.sh
100.20.58.101 Sectigo RSA Domain Validation Secure Server CA	`2024-05-17` - `2025-05-22`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-09-11` - `2025-03-11`	6 months	crt.sh
webtracker.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Frame ID: AB8AC8A118AB0ED83B3710F1C39F93E4
Requests: 226 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 0E42262BC6B19D886A73FBE1FDBDC365
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=1128146875.1726838110;ps=1;pcor=1425848075;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Frame ID: 016AF8846C96DF8374DC18C734ADBA46
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/609297413?random=1726838110705&cv=11&fst=1726838110705&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: A5088EBB14AB7F55DF1F5EC43163FA82
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/729495989?random=1726838110786&cv=11&fst=1726838110786&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 47822AF9366C8843FC5EBF3983169CD9
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/662878185?random=1726838110868&cv=11&fst=1726838110868&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 26B801D38F4B6DF6723C68A2D86074D1
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=CLPg4KHN0YgDFfdZDwIdrmoEgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4123233115907.0103
Frame ID: 7A0B39D10849B717B4B9501D18EDF520
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401 | FortiGuard Labs

Page URL History Show full URLs

https://401.tw/Mr6E HTTP 307
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-... Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

FingerprintJS (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/fingerprintjs@(\d)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

237
Requests

86 %
HTTPS

27 %
IPv6

63
Domains

93
Subdomains

74
IPs

6
Countries

6852 kB
Transfer

10723 kB
Size

111
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/geoserver/geoserver
Title: open-source software

Search URL Search Domain Scan URL

URL: https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
Title: advisory

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36401
Title: CVE-2024-36401

Search URL Search Domain Scan URL

URL: https://geoserver.org/announcements/vulnerability/2024/06/18/geoserver-2-25-2-released.html
Title: addressed

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/alerts/2024/07/15/cisa-adds-one-known-exploited-vulnerability-catalog
Title: added

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/encyclopedia/ips/56197
Title: IPS signature

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/groups/G0096/
Title: APT41

Search URL Search Domain Scan URL

URL: https://github.com/fatedier/frp
Title: Fast Reverse Proxy

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/groups/G0059/
Title: Magic Hound

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
Title: Fox Kitten

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
Title: Volt Typhoon

Search URL Search Domain Scan URL

URL: https://training.fortinet.com/local/staticpage/view.php?page=fcf_cybersecurity
Title: Fortinet Certified Fundamentals (FCF) in Cybersecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fortinet/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://community.fortinet.com/
Title: Fortinet Community

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://401.tw/Mr6E HTTP 307
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 69

https://cm.everesttech.net/cm/dd?d_uuid=81988976200684861792468726032211474849 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11XAAAAF0pKQN7

Request Chain 170

https://secure.adnxs.com/px?id=1773420&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Request Chain 171

https://ib.adnxs.com/seg?add=36113683 HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Request Chain 178

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=48DDDBD30D29424C9F8B3A3C69A6314A HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=3372&partner_device_id=0fa13d61a2 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3372&partner_device_id=0fa13d61a2 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=a2de8d86-8e04-4b40-af2d-13933b7e67a5%252C%252C&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=a2de8d86-8e04-4b40-af2d-13933b7e67a5%252C%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=bac5e4e8-f265-4612-81ef-59735c488a2c&ttd_puid=a2de8d86-8e04-4b40-af2d-13933b7e67a5%2C%2C

Request Chain 179

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/48DDDBD30D29424C9F8B3A3C69A6314A HTTP 302
https://sync.1rx.io/usersync/simplifi/48DDDBD30D29424C9F8B3A3C69A6314A?zcc=1&cb=1726838111743 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-1e42aa08-ea35-4aa3-936f-e89fa4a94768-004

Request Chain 180

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=48DDDBD30D29424C9F8B3A3C69A6314A&dongle=yf3 HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=48DDDBD30D29424C9F8B3A3C69A6314A&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

Request Chain 181

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=48DDDBD30D29424C9F8B3A3C69A6314A

Request Chain 182

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=48DDDBD30D29424C9F8B3A3C69A6314A HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=48DDDBD30D29424C9F8B3A3C69A6314A

Request Chain 183

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=48DDDBD30D29424C9F8B3A3C69A6314A HTTP 302
https://d.agkn.com/pixel/10751/?che=1726838111664&ip=146.70.201.218&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D232903305011003804456 HTTP 302
https://um.simpli.fi/aa_px?sk=232903305011003804456 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 184

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=48DDDBD30D29424C9F8B3A3C69A6314A HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=48DDDBD30D29424C9F8B3A3C69A6314A&ckls=true&ci=MiBsknZbMz&nc=false&trid=1480368170

Request Chain 187

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=48DDDBD30D29424C9F8B3A3C69A6314A;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=48DDDBD30D29424C9F8B3A3C69A6314A;mimetype=img;sr HTTP 302
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Ffei.pro-market.net%2Fengine%3Fsite%3D161185%26size%3D1x1%26du%3D36%26csync%3D[sas_uid] HTTP 302
https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1

Request Chain 188

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=48DDDBD30D29424C9F8B3A3C69A6314A&j=0 HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=48DDDBD30D29424C9F8B3A3C69A6314A&j=0&xl8blockcheck=1

Request Chain 190

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=48DDDBD30D29424C9F8B3A3C69A6314A

Request Chain 191

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=48DDDBD30D29424C9F8B3A3C69A6314A

Request Chain 192

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=48DDDBD30D29424C9F8B3A3C69A6314A HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=48DDDBD30D29424C9F8B3A3C69A6314A

Request Chain 193

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=48DDDBD30D29424C9F8B3A3C69A6314A HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=48DDDBD30D29424C9F8B3A3C69A6314A&dnr=1

Request Chain 194

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=48DDDBD30D29424C9F8B3A3C69A6314A HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogNDhERERCRDMwRDI5NDI0QzlGOEIzQTNDNjlBNjMxNEEQABoNCN_qtbcGEgUI6AcQAEIASgA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEEMZC_G7ZpdPytOJodaAbkI&google_cver=1

Request Chain 195

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1726838111356&cv=7&fst=1726838111356&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=217406891&cv=7&fst=1726838111356&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjrxrECCJvHsQI&pscrd=IhMI44fqoc3RiAMVMofpBR3OSSRlMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=217406891&cv=7&fst=1726838111356&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjrxrECCJvHsQI&pscrd=IhMI44fqoc3RiAMVMofpBR3OSSRlMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSLADpaXnfL5wa_2cKT97GlvkbRgDIiZ27ur3pgneSeRwuCZbVbGSRMOMVCWab&random=2776063906 HTTP 302
https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=217406891&cv=7&fst=1726838111356&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjrxrECCJvHsQI&pscrd=IhMI44fqoc3RiAMVMofpBR3OSSRlMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSLADpaXnfL5wa_2cKT97GlvkbRgDIiZ27ur3pgneSeRwuCZbVbGSRMOMVCWab&random=2776063906&ipr=y

Request Chain 197

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=48DDDBD30D29424C9F8B3A3C69A6314A

Request Chain 198

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=48DDDBD30D29424C9F8B3A3C69A6314A&expires=365

Request Chain 199

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=48DDDBD30D29424C9F8B3A3C69A6314A

Request Chain 200

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_gid=CAESEMybglbkbSDT5xPuA_fQkp8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=48DDDBD30D29424C9F8B3A3C69A6314A HTTP 302
https://um.simpli.fi/g_match?id=

Request Chain 201

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4123233115907.0103 HTTP 302
https://10104846.fls.doubleclick.net/activityi;dc_pre=CLPg4KHN0YgDFfdZDwIdrmoEgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4123233115907.0103

Request Chain 218

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838111852&li_adsId=67a4cdbe-3db5-471e-80ef-14abbb43c629&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%26time%3D1726838111852%26li_adsId%3D67a4cdbe-3db5-471e-80ef-14abbb43c629%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838111852&li_adsId=67a4cdbe-3db5-471e-80ef-14abbb43c629&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838111852&li_adsId=67a4cdbe-3db5-471e-80ef-14abbb43c629&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&liSync=true&e_ipv6=AQJPERtXHo1MJwAAAZIPkoBgYVwpuGdp201PECTAw837k5Radyr0LkmJUYKsghBTv7HKOw

Request Chain 220

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=bac5e4e8-f265-4612-81ef-59735c488a2c&gdpr=0&gdpr_consent=

Request Chain 221

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3647144416274022480 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3647144416274022480 HTTP 302
https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144416274022480

Request Chain 222

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=28rlz1nDf6nyKXsXHwWRGYRupAaetKFBIFZo_Aff81zA&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

Request Chain 223

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838111391 HTTP 303
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838111391&_bee_ppp=1 HTTP 303
https://tracking.contanuity.com/usersync?bwcookie=AACBx07N2usAABPjJrtzPA

Request Chain 232

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=5ec077ab-7752-11ef-8656-0f0bcdde48dd&gdpr=&gdpr_consent= HTTP 302
https://px.steelhousemedia.com/tdsync?tdid=bac5e4e8-f265-4612-81ef-59735c488a2c&shguid=5ec077ab-7752-11ef-8656-0f0bcdde48dd

Request Chain 233

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=bac5e4e8-f265-4612-81ef-59735c488a2c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://tags.bluekai.com/site/5386?id=bac5e4e8-f265-4612-81ef-59735c488a2c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=bac5e4e8-f265-4612-81ef-59735c488a2c&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YmFjNWU0ZTgtZjI2NS00NjEyLTgxZWYtNTk3MzVjNDg4YTJj&gdpr=0&gdpr_consent=&ttd_tdid=bac5e4e8-f265-4612-81ef-59735c488a2c HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=bac5e4e8-f265-4612-81ef-59735c488a2c&google_gid=CAESEAY2Qn-Zn-w5UbzkOknzS6U&google_cver=1 HTTP 302
https://su.addthis.com/red/usync?pid=11124&puid=bac5e4e8-f265-4612-81ef-59735c488a2c&url=https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fgeneric%3fttd_pid%3daddthis

237 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request threat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Show response
www.fortinet.com/blog/threat-research/
Redirect Chain

https://401.tw/Mr6E
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

103 KB
29 KB

841ms
522ms

Document
text/html

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

3d6bc3dbcf9e2cf02f556ae8bd0936e8b62540189823df29c4f524c060bb8328

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Age: 86686
Cache-Control: max-age=600, public, s-maxage=10800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 27960
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Type: text/html;charset=utf-8
Date: Fri, 20 Sep 2024 13:14:57 GMT
ETag: "19b93-62278a4ad0fc7-gzip"
Last-Modified: Thu, 19 Sep 2024 13:10:14 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 f626414885b2faf7a229c7fb2778d5c8.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ZW31SJMZjTICwqhNP4XhEqHF2L1rk05JBZGWxrVz3E0nHEj__YStcA==
X-Amz-Cf-Pop: SIN2-P4
X-Cache: Hit from cloudfront
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher1uswest1-28559594
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 142
Content-Type: text/html; charset=utf-8
Date: Fri, 20 Sep 2024 13:15:01 GMT
Location: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Server: nginx/1.26.1

GET
H/1.1 200
OK visitorapi.min.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 64 KB
30 KB 74ms
73ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "fe2d-6117284c96900-gzip"
Age: 330508
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: M79fxbZ4kCige_kJXyuKxqjiHxjrI9dAZcV_B08rBs2_WjVgNseZoQ==
Date: Mon, 16 Sep 2024 17:27:27 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 15 Feb 2024 21:43:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 f626414885b2faf7a229c7fb2778d5c8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29532
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK at.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 104 KB
48 KB 214ms
76ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "19e83-61431fc4b24c0-gzip"
Age: 330469
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Ytr2OD3YkpmdN_gjnV8UnXpMNKyxdUtc-3E-el0y2bdViKbRWbSNVQ==
Date: Mon, 16 Sep 2024 17:27:28 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 21 Mar 2024 20:59:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47782
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 540 KB
28 KB 220ms
83ms Stylesheet
text/css 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "86e1b-61b58998583c0-gzip"
Age: 5163981
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: sz_6Ww0hIR4LijJRqO6zmjLZ1S1CQtEZy9M33ebkA1R4uORmeRzZPA==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: text/css;charset=utf-8
Last-Modified: Thu, 20 Jun 2024 21:00:07 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27478
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 2226ms
18ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: jwlUUXc1HMPClYXMpY+NPQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCD8180F629235
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 47099
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:05 GMT
content-type: application/javascript
last-modified: Wed, 18 Sep 2024 19:28:22 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 6758b5e5-201e-0098-0fc4-0a1db5000000
cf-ray: 8c62150e0e3bd5c8-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6881
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 214ms
76ms Image
image/svg+xml 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 34042422
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: -PxyUa1AEimBznqt2SbHtcRv2BV0r7QKSwqx-QiHmUGKyNUJVvHiuw==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
3 KB 220ms
82ms Image
image/jpeg 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "4fd-60a2031eb4f40"
Age: 26854839
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: mA_Zpb058-L-50-rKnwL-yQPujTp7QJTplzC02rjT_dnHu2kr_tRRw==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 160 KB
74 KB 77ms
76ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "28100-61cff12ce1d80-gzip"
Age: 5163982
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: fA3mPej2zA9u2lUfMmtcMn9c3ulbKKXNRA8Zxj2b-_AzcLsC3evTBA==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: application/javascript;charset=utf-8
Vary: Accept-Encoding
Last-Modified: Thu, 11 Jul 2024 21:01:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 74768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 5 KB
2 KB 60ms
52ms XHR
application/x-javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Uj3iBUKm1Vl2g2NHq67V+w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF23DF5130
age: 74510
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 21 Sep 2024 13:15:06 GMT
date: Fri, 20 Sep 2024 13:15:06 GMT
content-type: application/x-javascript
last-modified: Thu, 28 Dec 2023 19:56:54 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-ms-request-id: c21183be-301e-00a5-5054-cda893000000
cf-ray: 8c6215139a698a90-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1792
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
1 KB 81ms
80ms Image
image/svg+xml 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 34042425
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 6hlTZozMTDyY-3gH6lL_Knt9OhQB1XqwCU8Oq191Mk-vzKJy1w7EQg==
Date: Fri, 20 Sep 2024 13:15:06 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK geoserver-hero.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 370 KB
372 KB 75ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/geoserver-hero.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

83201017e411b72434080a221b102049e9074e205d97f65219d2286abd683012

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "5c8ee-621505f67c380"
Age: 1296295
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: HTH--yWNfFmHMYzFURg0JWqvXpsVDnOngR752YyW518QGVLglJsVJg==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 19:42:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 379118
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK chavecloak-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 37 KB
39 KB 79ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/chavecloak-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

fd9f918bd5a22813d48748b8c79e2acaeeb590d217575e0d79d734cba9de7736

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "9490-611dcced7f240"
Age: 14248934
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: -E7SUDMw7znfXRAliOOwY2e_0HWktkJ2HoIdoEf9K97993ugWxa1Qg==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/png
Last-Modified: Wed, 21 Feb 2024 04:32:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 38032
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK scrubcrypt-24-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 43 KB
44 KB 80ms
79ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/scrubcrypt-24-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

2eceae481c2cda87ecdc8e65c8bbd62ddc9538144c42ff6c1cd720cd5781623c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "ab05-6155cc8f5f240"
Age: 14245008
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: M-EuP9nfOyKygu-dTmCiD7eFQyf5EOtWrXRbyWK45Xmk6LN0ZV8fMQ==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Fri, 05 Apr 2024 17:28:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 43781
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK lumma-variant-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 46 KB
48 KB 79ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/lumma-variant-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

11c69167edad4aa2ac0c3def81f10e2caf7375ca37d9170e9277ac2cef39eb32

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "b8c6-60dff3ae26100"
Age: 22103901
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: hHCe7TsieafE5bCa-3pNTnynvSzXvWCneNVJke2x-elrL_ekLo2fEg==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Tue, 02 Jan 2024 23:55:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47302
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
38 KB 90ms
81ms Font
application/octet-stream 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Response headers

X-Vhost: publish
ETag: "9354-5df4fa74ff980"
Age: 330547
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Uzh6zeV3HA5Poa9VOaStpUEVBQatWiOCUm5Hq4azSm0Gbfwo5AWxXA==
Date: Mon, 16 Sep 2024 17:27:32 GMT
Content-Type: application/octet-stream
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37716
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig01-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1725493359930/ 61 KB
62 KB 95ms
90ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1725493359930/fig01-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6bb4e76fdeac3f86fe514013ea4ec43b69cf824a9cb00b4d90ca33eb27df3712

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "f3de-62153bab9b9c0"
Age: 1283673
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 9u52CAaTrIRNZ1PchKlid_uEEI0UzMCj_cqene4IlcPGabce0Sy5zw==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 62430
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
305 B 123ms
35ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

291ac3898f3f28bd32810a5ef0f380363afee480e535632f0254da751f775c63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8c62151b4b0a268b-NRT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H/1.1 200
OK fig02-geoserver-script-file-remote-sh.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_542065486.img.png/1725493737369/ 449 KB
451 KB 106ms
84ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_542065486.img.png/1725493737369/fig02-geoserver-script-file-remote-sh.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9cbf9589d98422a08f788b3863a74d1a27c3d92289f8829620c4d8925b967b94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "70532-62153d1418c40"
Age: 1284552
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: qm_VID0SBrOq9gKhbWBH-7sS9lYIS4CJRhCQwWA05RT6eL_bsvXMYA==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:48:57 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 460082
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig03-geoserver-gorevese.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_992669665.img.png/1725493760506/ 50 KB
51 KB 107ms
84ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_992669665.img.png/1725493760506/fig03-geoserver-gorevese.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

38cfaeb6a3cb2cff2b9b11f9945838fd640ac7c0483e093239a29400c7d2ee66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "c6c1-62153d2a08000"
Age: 1284624
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: v5tSoFbv_Bkaj49OKHKkEhQsyMApyaD_QNDMUDwRnC0c2WkrUOaA2w==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:49:20 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 50881
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig04-geoserver-goreverse-log.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_744399015.img.png/1725493351601/ 265 KB
267 KB 107ms
84ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_744399015.img.png/1725493351601/fig04-geoserver-goreverse-log.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

07405b002bac345765f6de032ed07cac28e77745e73850bf4aed8f891822c37a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "42511-62153ba3fa7c0"
Age: 1284624
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: SfwWBY6gu8e4WHrGFDnluZnkrKdGrmC_13HYb_IDwx8q6zzjYxy5yw==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 f626414885b2faf7a229c7fb2778d5c8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 271633
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig05-geoserver-goreverse-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_963623453.img.png/1725493337854/ 75 KB
76 KB 261ms
110ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_963623453.img.png/1725493337854/fig05-geoserver-goreverse-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

4713f4e99bebe488012bb9f5ccbaa25d83f2ecec4dbfc2c71f81ad33df9d1c10

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "12a2b-62153b96a0840"
Age: 1284552
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 8HOSsoQ541yxVlylP8_k6y0-v4Pn1rs3EUZ6lAjcl4f_D9UfEq817Q==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 76331
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig06-geoserver-script-file-d.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1712359983.img.png/1725493331271/ 185 KB
187 KB 116ms
104ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1712359983.img.png/1725493331271/fig06-geoserver-script-file-d.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f188b1683849ebab2c42aa623674d573d89c3a8b8a533f4e2ec35fe7a9e8000e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "2e589-62153b90e7ac0"
Age: 1283672
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: _Q8OEnJmMljK3810DBclNZrY3uF-mNOGkTZvq9r0BHSui-3HZycjeQ==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:11 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 189833
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig07-geoserver-creating-folders.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_219608780.img.png/1725493380912/ 113 KB
115 KB 92ms
90ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_219608780.img.png/1725493380912/fig07-geoserver-creating-folders.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

706300e054788f930de76af585fc6511091289d01c65c440964ca6abb898e7dc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1c505-62153bbfa2900"
Age: 1284623
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 2A52QpKjyC009bWiMzgszspjdOlWa2GLgiNJbgWyDCu539FUEx10bA==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 115973
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig08-geoserver-xor-decoded-0x60.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_359750668.img.png/1725509365855/ 115 KB
117 KB 88ms
81ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_359750668.img.png/1725509365855/fig08-geoserver-xor-decoded-0x60.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

c6c7eafdd4ce7cbca90175e42e4d11a9ebcfaed70b6471572a0d3d0ae7dde57f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1cd07-6215774c1e740"
Age: 1284552
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zq2VbHBUOX9wm8o_p_0bS_Z11HyP1PBTPkpALLqPyTlmUPzzTvlLkg==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:09:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 118023
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig09-geoserver-saved-decoded-files.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1078076399.img.png/1725493420288/ 33 KB
35 KB 75ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1078076399.img.png/1725493420288/fig09-geoserver-saved-decoded-files.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b133508601dd82610cda75ed20bc034dd90b459dcd74b8b44e75998e38d19477

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "85a6-62153be5c8300"
Age: 15165
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 4tBc1DafLHbBcz1wyJS7kENNwsWQ5psVLANkJFuLCbtNNf5tZyKdAA==
Date: Fri, 20 Sep 2024 09:02:23 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:40 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 34214
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig10-geoserver-xor-decoded-0x89.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1956682136.img.png/1725493436943/ 131 KB
133 KB 143ms
142ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1956682136.img.png/1725493436943/fig10-geoserver-xor-decoded-0x89.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5b7b4be8ed582776a1ad52eed0fe06afe968c34e31d566c473feb92ac6a270e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "20cd5-62153bf50a700"
Age: 1283673
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 3YvnuYYfLy5k4hEZXv_yAn2I5oOuJE1av2uMCrvZQAQyvrxCW1n4ZQ==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:56 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 134357
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig11-geoserver-decrypted-configuration-chacha20.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1654479811.img.png/1725493462325/ 41 KB
42 KB 133ms
132ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1654479811.img.png/1725493462325/fig11-geoserver-decrypted-configuration-chacha20.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

44fc655655fedce3141e358eabb02c39e838d48e6643b1c58c395adfc23757d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "a2f9-62153c0dd6180"
Age: 1283673
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zbe8msXRGGLZE23L1jTCIcm-tUzIr22SzvoYEpovpracC5Uz3lTPDQ==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:44:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 41721
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig12-geoserver-encrypted-binary.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_881935709.img.png/1725493495125/ 160 KB
161 KB 115ms
114ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_881935709.img.png/1725493495125/fig12-geoserver-encrypted-binary.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2ac7d5402f2266e77a525cf70164ad40fb86b0981530cad5af3e3610a209768

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "27ee7-62153c2d4ebc0"
Age: 1284623
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: NLOwzqZV0LE5OWP4vP1hjxkAwhZixrOsvb2W0-Vxxe1LzDLNHJpwLg==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:44:55 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 163559
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig13-geoserver-decrypted-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2093410339.img.png/1725493500451/ 121 KB
122 KB 95ms
95ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2093410339.img.png/1725493500451/fig13-geoserver-decrypted-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e8f00eb416ad5af6f4524e1b7efd086a2244bf48757eee0fbdf583c20afa1dad

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1e310-62153c3213700"
Age: 1284553
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Ho9SxGQA_fAjc99eXl7sy60hZUgVrWUPYv1EnlJMUkgDxKOGkkVBOQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 123664
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig14-geoserver-packet-capture-c2-connection.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1728308731.img.png/1725493517259/ 138 KB
140 KB 104ms
81ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1728308731.img.png/1725493517259/fig14-geoserver-packet-capture-c2-connection.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9ae293c59bba08f1a56f697a11015ee4b251b0f38c309f83c80d7f6e7369caa4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "229ef-62153c4249d40"
Age: 1284552
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Lyl9fN4eMJajLFlhd0IRnx2En6yx_3Kjy2VUEW454hyWfP3hqkd6gw==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f626414885b2faf7a229c7fb2778d5c8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 141807
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig15-geoserver-c2-communication.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1929634219.img.png/1725493533356/ 71 KB
73 KB 97ms
84ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1929634219.img.png/1725493533356/fig15-geoserver-c2-communication.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

89905a0e0efe1119d95b1e69de27157b35b8043115708fa06eb74dc706568a7b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "11cc6-62153c518c140"
Age: 1284623
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: uQI96VRv5zNTPOKe-AilCDzO-r40W79TPpPth09_OZdAzVYTABhRvg==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 72902
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig16-geoserver-fpr-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1939040249.img.png/1725509412346/ 129 KB
130 KB 101ms
94ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1939040249.img.png/1725509412346/fig16-geoserver-fpr-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

fd688f7a638dad7a8d7c394f5443ed8ccb3158d4555937c1e0f51546b2fc9612

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "20403-62157778f1100"
Age: 1284624
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: rboKW9b_XSfQz9X_XKBOPsueqoiqUnXt_mNZAoFUe8bJ7BEO5Itlzg==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:10:12 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 132099
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig17-geoserver-packet-capture-fpr.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_763250428.img.png/1725509429420/ 106 KB
108 KB 88ms
81ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_763250428.img.png/1725509429420/fig17-geoserver-packet-capture-fpr.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

609ca44aa6a92944559e4d17e84e29651b391c6c3438184474fd67e602250e7d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1a98f-6215778927740"
Age: 1283673
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: swoo_i2DlOjUvsO98gXH9A8qe9F-U6TYSITdmuGBB2vSsMxO_LsUIw==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:10:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 108943
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig18-geoserver-telemetry.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_44410991.img.png/1725493592407/ 93 KB
94 KB 92ms
81ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_44410991.img.png/1725493592407/fig18-geoserver-telemetry.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8d121b33124fce841c6927c1214d2aa4fe7e5c52629de45f68f325f749a5857d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1725d-62153c89d0600"
Age: 1284623
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zFHQbLpvLmaqcSdDV1wel6JAlSqO14HdiAuPn68S-KA59DalNs9VcQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:46:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 94813
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig19-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1852080368.img.png/1725493624336/ 117 KB
119 KB 90ms
86ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1852080368.img.png/1725493624336/fig19-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ae7d18a41edd5f27e717f872a1113addddbf1553e00b3db1baefa99b68fda302

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1d5d5-62153ca854e00"
Age: 1284623
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: m5QCkE-xv0DlCZbTKGVrxlnBki-FNGyyCJ7DYyRuGvMq8OHyiYh6vg==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:47:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 f626414885b2faf7a229c7fb2778d5c8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 120277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig20-geoserver-xor-decoded-function.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_898199783.img.png/1725493640566/ 30 KB
32 KB 83ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_898199783.img.png/1725493640566/fig20-geoserver-xor-decoded-function.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

a4b0a228372854369707f452fb9124e5bc34319c8c3323b5379111ac9ba4bac6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "794f-62153cb797200"
Age: 24801
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: M0BFOoujk2f2apkugKgm-nm_iz00ZJva_okhjs1ZwNUCb84RlF4u0g==
Date: Fri, 20 Sep 2024 06:21:47 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:47:20 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31055
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig21-geoserver-decoded-config-data.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_88540031.img.png/1725493799908/ 18 KB
19 KB 84ms
80ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_88540031.img.png/1725493799908/fig21-geoserver-decoded-config-data.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f2771985061ab617dd696611136d31d58dba565372eaf86c562d59d8bae3fd9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "4702-62153d4f397c0"
Age: 1284623
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: pgGNCTKTpjjrTFx6jzcvHSTXC00okGzRjyNikNiCPpy1sWOLzRP7CQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:49:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 18178
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig22-geoserver-execution-msg.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2095532140.img.png/1725493821159/ 26 KB
28 KB 85ms
83ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2095532140.img.png/1725493821159/fig22-geoserver-execution-msg.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

351ba146db40e108b8dcbf0f9cc288d6cc19615020b2aeb1c0f508b79e78b93e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "69e7-62153d6434940"
Age: 1283674
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: JX9HwGx_WX4tBw7rXjkpNa6Hv3lmJW5I6G_Pps7qPuMQ31apGeM8Sg==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:50:21 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27111
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig23-geoserver-hard-coded-payload.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1513040984.img.png/1725493835492/ 117 KB
119 KB 82ms
79ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1513040984.img.png/1725493835492/fig23-geoserver-hard-coded-payload.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5f83323b31dd79cc7f9104b638a2706b0e12b6e521f48d21ba638b67279f4417

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1d57e-62153d718e8c0"
Age: 1284622
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: S4bbF2Mu5tAf8RwAdTXCKvkdduxnWKIEm0IJYQTBktgP_w5d6WtbrQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:50:35 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 120190
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig24-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_982915008.img.png/1725493868694/ 154 KB
155 KB 80ms
78ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_982915008.img.png/1725493868694/fig24-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8b195a98b1a9fa227dd6712c4af7ccbd807baa4a4b21491d97dbc09c1e13798a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "26815-62153d9107300"
Age: 1283674
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: fcXPWUQ-3k8nfFGzA_OxsOdakDC45IUhD4lqWP_tUB8vQp_jHUx1HQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:51:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 157717
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig25-geoserver-significant-string.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_903278817.img.png/1725493885710/ 27 KB
28 KB 81ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_903278817.img.png/1725493885710/fig25-geoserver-significant-string.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

2cc20824e35c6be438211ca8dcf0baa6b8e6df5473454d953a0c96d10eedae7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6a84-62153da13d940"
Age: 1284137
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 2WsuK1mB8I2kXGvQ6fJJkxFOdl_olA4czOx_eDqjlq3H5LSOc9vmYA==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:51:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27268
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig26-geoserver-continually-connecting-c2-server.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_15414132.img.png/1725493922547/ 155 KB
156 KB 79ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_15414132.img.png/1725493922547/fig26-geoserver-continually-connecting-c2-server.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6305f99e66b3ae3c375efe4b1128ab3dcdc2d66c63b97ba6b891096de9b20b9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "26a3d-62153dc486c80"
Age: 1283674
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: JY2ypfy8RMfD7til8CeftIgi_7RRcoL4wBlPuxnQm9s_HQG3R17L4A==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:02 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 158269
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig27-geoserver-ddos-attack-methods.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_275647643.img.png/1725493939962/ 64 KB
65 KB 102ms
97ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_275647643.img.png/1725493939962/fig27-geoserver-ddos-attack-methods.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

21aaea8d55693ea73c2e3d8afbf8358f3bfa56ae0d8a0abb07221a83373da2d5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "fe15-62153dd4bd2c0"
Age: 1284621
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: iwIVfY_uj5_AH2ZcWwyv6O6jyVPKtSrNsxXYdzDfljlqPKJx-sA0fw==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:19 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 65045
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig28-geoserver-creating-service.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_876069744.img.png/1725493958694/ 60 KB
61 KB 96ms
90ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_876069744.img.png/1725493958694/fig28-geoserver-creating-service.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8ff6ee1950e6f70a130f69e94e575f9d5f7c5de60be4be09311deedeb91e6d61

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "f051-62153de6dbd80"
Age: 15163
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: rgMLReBkstNNeaYotL_6QSRU7twTKySQ12FUPvIw95nARHFBcE23eQ==
Date: Fri, 20 Sep 2024 09:02:26 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:38 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 f626414885b2faf7a229c7fb2778d5c8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 61521
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig29-geoserver-command-execution.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_463601972.img.png/1725493975114/ 122 KB
124 KB 89ms
82ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_463601972.img.png/1725493975114/fig29-geoserver-command-execution.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

c3a522b15c8dd585c2cb4e503fdce8145d08a8eccb0e2cd7138864bba293c843

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1e99b-62153df7123c0"
Age: 1284553
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: K7BAMHfcyxY9WXI5ej1o4VpTy33joB5-uwDT0LEtUcA347WtidtCug==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:55 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 125339
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig30-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_131843470.img.png/1725493991014/ 79 KB
80 KB 79ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_131843470.img.png/1725493991014/fig30-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

61c4417c2b9d4cba0069ef57a404bd5d9c7a7e4c768f57747b1c084cb9b373ce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "13af8-62153e06547c0"
Age: 1283675
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: PI67de0MwXJnsdZiGXGzHlANW0rcSSxzgA9yn-2yLRx2CfglkkYpsw==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:53:11 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f626414885b2faf7a229c7fb2778d5c8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 80632
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig31-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1205773152.img.png/1725494041702/ 198 KB
199 KB 81ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1205773152.img.png/1725494041702/fig31-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e708a54b75ed6fd1fe7886153e485c91697f1ab440feed4efd10262575b7e7cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "31604-62153e3603840"
Age: 1284553
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 6IJn9NIDVGAD4lhxmv5trx_3Gyy67vIu6Q3fDuIAn1llX7ZOXywYow==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 202244
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig32-geoserver-download-persistence.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1440737303.img.png/1725494062034/ 85 KB
87 KB 86ms
82ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1440737303.img.png/1725494062034/fig32-geoserver-download-persistence.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d98bf7483812de53be541b21b22b1cc519065b76ed31780f33bf8254e688812f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "155fb-62153e4a0a780"
Age: 1284621
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: mHISPct-3WGRRjICuMvv7_rBsoQ4ZaMcXcuDxwKptL8m_2tPAPELpg==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 87547
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig33-geoserver-coin-miner-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1886495638.img.png/1725494085500/ 108 KB
110 KB 78ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1886495638.img.png/1725494085500/fig33-geoserver-coin-miner-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6277e3210b9fb4b3b4f0d452b7f91bda534fb23f8ecbe7f9b15dcdf85626cea6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1b0fc-62153e5ff9b40"
Age: 1284553
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: H96tlMfm-vMsQaulIe6DGr6IoJrzaD-85sFFg4zv9ha8oUPWLpWpgQ==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 110844
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig34-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_438526620.img.png/1725494099321/ 69 KB
70 KB 77ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_438526620.img.png/1725494099321/fig34-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b124eed22afdf03abf94714c7632d5f462c0fca7725d014a4469f3b4a0f1083d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "11459-62153e6d53ac0"
Age: 1284552
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Lic7mVvfdLMg-J-aUqKEjKkc1-gK7R3iGmp7pI_L9-hLIGXBt8x4Wg==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 70745
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig35-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_843460720.img.png/1725509976835/ 94 KB
96 KB 77ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_843460720.img.png/1725509976835/fig35-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

0be9fc1923bfa5bd67a699ff0f49420e460c09b27bcb63dd4d682a0fa2ef5b5a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "178b4-62157992d0600"
Age: 1284553
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: bWXZD2AU_nbl9qqZ2FHiC3_4FQufGF_IgprD_One2mitnr12Ufw2MA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:19:36 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 96436
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig36-geoserver-config-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_966339368.img.png/1725494131259/ 27 KB
28 KB 81ms
80ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_966339368.img.png/1725494131259/fig36-geoserver-config-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5072cb8f4c6522e91c53fa0b2c4a36a3aa078b5b78ac9d48f317649a055a1e1d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6c22-62153e8bd82c0"
Age: 1284553
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 6fy_r6sUi8-KqWYEBY14lutMmdbyebqeoZ2HmGCQ8ee7RyRC-BrIeg==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:55:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f626414885b2faf7a229c7fb2778d5c8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27682
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig37-geoserver-coin-miner.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_171562763.img.png/1725494150273/ 144 KB
145 KB 76ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_171562763.img.png/1725494150273/fig37-geoserver-coin-miner.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5b7e10ef15a4fdfd73c69fa16e91aef21861455628f5ac87e72bb5f951e9976c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "23eb3-62153e9df6d80"
Age: 1284619
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: p4H_e5Z2pku3DYnsbCK0T762D0UNDNC5TRIj_n3Cj4KHOZ1O-bq-Kg==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:55:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 147123
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig38-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1859114048.img.png/1725494168657/ 175 KB
176 KB 86ms
85ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1859114048.img.png/1725494168657/fig38-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

229849a4c44505b2599f1a321b139fb5ab32d04a4e0f8d9844b1827e60b80d9f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "2bb8d-62153eaf21600"
Age: 1283674
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: vnpu3l1VRqmkhqIfKWv4jM5WjHPLp5QrLpF6dq86bEz5V8m7X3shyA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:56:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 179085
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig39-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_444774974.img.png/1725494192518/ 74 KB
75 KB 77ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_444774974.img.png/1725494192518/fig39-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b66a76be051ae670f5c2786172af1a704f1ecdb15aea3c3402fb42b9e5470598

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "127f9-62153ec604c00"
Age: 1284553
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: utiCSqTSL_k5g_YCdFE0t0O5chj9MESP0ZCb0rOIaIvley5XZLDfow==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:56:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 75769
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig40-geoserver-config-data.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1528863320.img.png/1725494220090/ 127 KB
128 KB 103ms
102ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1528863320.img.png/1725494220090/fig40-geoserver-config-data.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ec58ceb768e02c31b87f084fbe10f719b0c42d29c98fcca298688768c6f899e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1fbf5-62153ee0b8b00"
Age: 1283674
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: aoFTfIqJD84xU_NL3QWIr7jD7ARZmUNzzH1gp6hUWpO_6yYTaUobXg==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 130037
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig41-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_198093276.img.png/1725494235796/ 53 KB
55 KB 84ms
83ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_198093276.img.png/1725494235796/fig41-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

7fc88a2ccff93251684fc0526a1ef83f6b65bccc949e449d86f4df1bf945da94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "d499-62153eef06cc0"
Age: 1283675
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: XY9V07GOvuC_KCkyWZfDhHJW1OwAYlA41oJNB8-cjWPu9HwL9j9f5w==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:15 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f626414885b2faf7a229c7fb2778d5c8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 54425
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig42-geoserver-fraudulent-site.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_280569393.img.png/1725494252217/ 64 KB
66 KB 80ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_280569393.img.png/1725494252217/fig42-geoserver-fraudulent-site.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

a036dd51b9d09070b4cb8eaa91c1a5abac51f7027e9741c79343a35411be739c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "100f5-62153eff3d300"
Age: 1283674
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: o8R3rcOlyHxsKWjCxwB-dD77AJue9SdW59Lmyi4df5HZgB_5mT44ZA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 65781
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig43-geoserver-script-file-cron.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_212093578.img.png/1725494289081/ 35 KB
36 KB 83ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_212093578.img.png/1725494289081/fig43-geoserver-script-file-cron.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8a84bc1c645bc2d9b6e41e4e8b4582c2dbd3569b51df5ecedc989410e6be8fe7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "8ba4-62153f2286640"
Age: 1283675
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 08SNNKAb3RQM6asGRajcgkcm4mhBbU2qLgITkrz3CC3QRheK0SL9Xg==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7bea99dca3e2f37b7ddf97303d5b881e.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35748
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig44-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1895558288.img.png/1725494284576/ 26 KB
27 KB 75ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1895558288.img.png/1725494284576/fig44-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f8f726a217af8471c5c0e2c11fca16865b7dc42485185311fcbfa0603a4f7120

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6813-62153f1dc1b00"
Age: 1284551
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: NqA6ZNgDRWK5YyScfC0cD7r38pHGWhFaIeKI4CSHRxD0aUPuKuWktA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bd549265b50500a9fe6f638d6f06192a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 26643
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig45-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_849748280.img.png/1725494304387/ 30 KB
31 KB 81ms
79ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_849748280.img.png/1725494304387/fig45-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

da9671920127171a9289888088dc3d9f3b62f2af8c3ac142f456faa1d49eccda

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "77a6-62153f30d4800"
Age: 1284552
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: KPcpaDhID0gy62qXuV8p4niXpotlV9gq22GAcIwhIXxNsJCUIcRtQA==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:24 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 30630
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.10.0/ 356 KB
78 KB 92ms
13ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Bh9exWOPGIwRshWljrtlEw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735260901BC
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 45894
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: application/javascript
last-modified: Thu, 03 Dec 2020 02:43:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 5da0eb33-101e-0014-2cda-b5820d000000
cf-ray: 8c62151c78e2d5c8-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 79698
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/ 99 KB
24 KB 42ms
25ms Fetch
application/x-javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: SDJFQYswktbx6w5cJzzMRQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF2B6F9C71
age: 44538
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 21 Sep 2024 13:15:08 GMT
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 28 Dec 2023 19:57:06 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-ms-request-id: 16a02b50-101e-0023-7a72-79a340000000
cf-ray: 8c62151f1bda8a90-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24004
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 13 KB
4 KB 29ms
22ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: W9e0YobmEbvdB0V9OmpQkw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735209A34D6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 44966
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: e7ba9f8a-a01e-0009-5512-247c50000000
cf-ray: 8c62151fbce98a90-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3329
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 45 KB
12 KB 48ms
42ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: zNsRoM1FEmsEgJoYMCNTng==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D897352245C4EA
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 47510
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:53 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 77f313b5-301e-0034-7eb4-210a4b000000
cf-ray: 8c62151fbcea8a90-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11755
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 509 KB
121 KB 75ms
13ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cfbffc5a6b6598cb0bf93565da00397f881e0198bf2f24c8d963e4c7cfb45abf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "859a562c3003b9443ad4e70b3020dad9:1726790028.604703"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 123481
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:48 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 id Show response
dpm.demdex.net/ 368 B
916 B 177ms
23ms XHR
application/json 13.112.211.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1726838108351

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.112.211.211 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-112-211-211.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

044bdbcf41f0f4586f1d54f3843c97a6e0ad55a9184cfd20d0ca0f3fc7ca6d52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-1-v062-048dcfb34.edge-tyo3.demdex.com 1 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: 3bRhU/OkQus=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.fortinet.com
content-length: 310
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 dest5.html
fortinet.demdex.net/ Frame 0E42 0
0 108ms
1ms Document
text/html 52.197.184.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.197.184.52 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-184-52.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 20 Sep 2024 13:15:08 GMT
dcs: dcs-prod-tyo3-2-v062-0ddad7db1.edge-tyo3.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Mon, 19 Aug 2024 12:39:45 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: c9RaqSa0QiA=

GET
H2

200

ibs:dpid=411&dpuuid=Zu11XAAAAF0pKQN7
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=81988976200684861792468726032211474849
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11XAAAAF0pKQN7

42 B
717 B

26ms
7ms

Image
image/gif

13.112.211.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11XAAAAF0pKQN7

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Server

13.112.211.211 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-112-211-211.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-1-v062-0f0285260.edge-tyo3.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: ggHIivOvSkE=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11XAAAAF0pKQN7
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Fri, 20 Sep 2024 13:15:08 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

POST
H2 200 delivery Show response
fortinet.tt.omtrdc.net/rest/v1/ 351 B
842 B 159ms
14ms XHR
application/json 63.140.50.233
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.tt.omtrdc.net/rest/v1/delivery?client=fortinet&sessionId=7fd725f7bc9f418389557648308f29ac&version=2.10.0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.50.233 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

f5e502c3f7f0d4f9c48ce3b790e297dd427601ee7676632ed89be138be48a6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 2430999c-304c-4da1-9790-741da65bef4f
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://www.fortinet.com
date: Fri, 20 Sep 2024 13:15:08 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 35 KB
13 KB 43ms
22ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "d8232f86c8016a8e0acaa7ecfdf72b3e:1722493571.189276"
expires: Fri, 20 Sep 2024 14:15:09 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 13012
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 3 KB
2 KB 43ms
16ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "bb4b6453e3ab80111a2b227318d22efb:1722493571.614634"
expires: Fri, 20 Sep 2024 14:15:09 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1597
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 0786.js Show response
script.crazyegg.com/pages/scripts/0117/ 7 KB
3 KB 126ms
80ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8db92e7cdc1ad40168c42e93b05d842e056d8a5b83ae96b95d2b1c546f828196

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1056
cf-polished: origSize=6998
alt-svc: h3=":443"; ma=86400
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: text/javascript
last-modified: Fri, 20 Sep 2024 12:57:33 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c62152798737379-NRT
access-control-allow-origin: *
ce-version: 11.5.282
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 70 KB
19 KB 72ms
12ms Script
application/javascript 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2c88a96aaccfda2bf3f3c29d069fea858423e9cebcc1392a1021ec76538498ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66e78018-1167c"
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 16:15:09 GMT
accept-ranges: bytes
content-length: 19151
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Mon, 16 Sep 2024 00:47:20 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 28 KB
9 KB 55ms
10ms Script
application/x-javascript 23.32.225.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.225.140 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-225-140.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8489534bde4ad3c3cedebecd11b9babe653de6b413922ec2b877c5bfcb33ee3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Content-Encoding: gzip
ETag: "7437febf15b08e005ac33eb9fc2707ae:1721634584.416148"
Connection: keep-alive
Expires: Fri, 20 Sep 2024 13:35:09 GMT
Accept-Ranges: bytes
X-CC: JP
Content-Length: 8614
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:09 GMT
Content-Type: application/x-javascript
Last-Modified: Mon, 22 Jul 2024 07:46:05 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 25f2dd15-02c6-4e7a-bc8b-c5722b49624d Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 520ms
78ms Script
application/javascript 34.87.122.136
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.87.122.136 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 136.122.87.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-request-id: F_b2HJhWtEg8iRuol90B
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
15 KB 144ms
83ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "803483b3aaadb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C03725D045FC4D3D879B38073300F68B Ref B: TYO201100113047 Ref C: 2024-09-20T13:15:09Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14402
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 15:43:41 GMT
vary: Accept-Encoding

GET
H2 200 RCac955f2e1e97429197e1e31aaec22e86-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1 KB
942 B 26ms
12ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCac955f2e1e97429197e1e31aaec22e86-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f90b5ef7baa9dfccda582eb0ec80a2e2848cd5b3edc866629cda33cf4ff6df48

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:09 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 685
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 9 KB
2 KB 26ms
12ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 10fc9a12b905f9f21665f11fa5b183eae31166f74fce090bf179eb4c823b5ecc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:09 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1846
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 358 B
485 B 26ms
12ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2589fe281a342d19f8ddcd924727496b916202c4e42edb2553f25074746db938

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:09 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 229
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 703 B
684 B 26ms
12ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 15c2c29198d9315260cc26261e96a036d215fa28a46836302a576392e0e20ecd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:09 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 427
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 360 KB
118 KB 191ms
92ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

128e745d89a0b8501715fcd47ae9d657f2ad6c56cd949d7da1335c82f3dcb214

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:09 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120797
date: Fri, 20 Sep 2024 13:15:09 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 RC06cd6a06a307489f80febc787462cb12-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 635 B
642 B 24ms
6ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC06cd6a06a307489f80febc787462cb12-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 320f37b3eca2011055c9ab5a10b5de0f57a22fd740e504fe7e02c9898041abbb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:09 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 385
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H/1.1 200
OK unifiedPixel Show response
tr.outbrain.com/ 53 B
321 B 406ms
120ms Fetch
image/gif 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?au=false&bust=0945574054478231&referrer=&cht=ot&marketerId=00ad3119690e692fd6990245f9741ea8f1&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&g=0&obApiVersion=1.1&obtpVersion=2.0.5

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

38.133.127.191 Sacramento, United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 54
content-encoding: br
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif;
x-traceid: b66a767ec970b4620238ec4b57543f8c

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 385ms
131ms Script
application/javascript 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

38.133.127.191 Sacramento, United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 39
content-encoding: br
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/javascript
x-traceid: 1820adf696519a5e8635ed2c48a4e29e

GET
H/1.1 200
OK 00ad3119690e692fd6990245f9741ea8f1 Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
516 B 72ms
40ms Script
text/html 23.32.225.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.32.225.140 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-32-225-140.deploy.static.akamaitechnologies.com

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
Cache-Control: max-age=60
ob-sent-time: 1726821107559
Content-Encoding: gzip
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Expires: Fri, 20 Sep 2024 13:16:09 GMT
Access-Control-Allow-Origin: *
X-CC: JP
Content-Length: 22
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:09 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
x-traceid: 63b794c791c786e18da33e49c2470af7

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 22ms
5ms Fetch
text/html 23.32.225.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.225.140 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-225-140.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Connection: keep-alive
Observe-Browsing-Topics: ?1
Expires: Fri, 20 Sep 2024 13:35:09 GMT
Access-Control-Allow-Origin: *
X-CC: JP
Content-Length: 26
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:09 GMT
Content-Type: text/html

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/site/ 10 KB
2 KB 79ms
67ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f313c8c3aaec2c1b82bdf04b99d12b5b456dd6e4ccb2957e7a584c42683eba5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 9
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/json
last-modified: Fri, 20 Sep 2024 12:57:33 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c6215287d6dd48f-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1782
ce-version: 11.5.282
server: cloudflare

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 51ms
13ms XHR
text/html 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-118-169.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.fortinet.com
content-length: 7
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 18 B
305 B 62ms
2ms XHR
text/html 2600:140b:1c00:39::1732:761f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:1c00:39::1732:761f Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: e72fc9693b94bd6f4cea4fa172adc70989eca7c72cbdcb48f51ceaa7063ab230

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:ac8:40:1e::2e
expires: Fri, 20 Sep 2024 13:15:09 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1726838109532_388834591_20452136_23_775_2_9_219";dur=1
access-control-allow-origin: https://www.fortinet.com
content-length: 18
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 237ms
182ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A09%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:09 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 187ms
169ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%225eeecf22b2d12a77a14639dce97b7a36%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227381d1d7c753fe2d8e217c3fdc44c0f17418dcc4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:10 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 db7349b994413162218df5c920535415.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 103 KB
35 KB 40ms
36ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df9f1f8f4deeec8193dbcf3074a9e4767db05cc6c3b4dca6a9cafff884fb0816

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1063
cf-ray: 8c621528da077379-NRT
cf-polished: origSize=105321
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: text/javascript
last-modified: Fri, 06 Sep 2024 19:46:55 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 180ms
172ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A40%3A1e%3A%3A2e%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:10 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 17532650.js Show response
bat.bing.com/p/action/ 370 B
426 B 54ms
35ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17532650.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

cee682bc57d94c16933b0422aa0bd7ad8c7a6e04643eb7ce170e2d5ce6e25b48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7702F8FE909242CF8B66E3EA31C14AB8 Ref B: TYO201100113047 Ref C: 2024-09-20T13:15:09Z
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 744 B
718 B 48ms
11ms XHR
application/json 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: 904ada5a93d55f8c5412c4472a62bfbc46e215422ebdea166d95ed3434d97d4f

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-encoding: gzip
x-6si-region: ap-northeast-1a
access-control-allow-credentials: true
x-trace-id: 5138859567469309133
access-control-allow-origin: https://www.fortinet.com
content-length: 395
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: nginx

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 77ms
3ms Preflight 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Fri, 20 Sep 2024 13:15:09 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: ap-northeast-1a
x-trace-id: 8252893404062374905

GET
H2 204 0
bat.bing.com/action/ 0
360 B 46ms
28ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=8aa39611-25a3-4a02-bdc6-1c1f080e8088&sid=5ca57160775211ef8e443b141d914c74&vid=5ca70630775211efbfdac720e7a8a5e9&vids=1&msclkid=N&pi=918639831&lg=ja-JP&sw=1600&sh=1200&sc=24&tl=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&kw=FortiGuard%20Labs%20Threat%20Research,Cara%20Lin&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&r=&lt=6398&pt=1726838100877,,,,,148,164,165,180,455,285,482,962,1117,2200,5406,5406,6398,,,&pn=0,0&evt=pageLoad&sv=1&cdb=AQET&rn=922019

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 94BE92206BF14B7EA58D8AE7DC264C78 Ref B: TYO201100113047 Ref C: 2024-09-20T13:15:09Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:08 GMT

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/sampling/ 46 B
256 B 32ms
26ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/sampling/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ef0e68967411e0314dcc9b45416c54100ebf112f0fc6dc08cc3e1f1f9fa0436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 8
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/json
last-modified: Fri, 20 Sep 2024 12:57:35 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c62152a88f9d48f-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 65
ce-version: 11.5.282
server: cloudflare

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 58ms
8ms Preflight 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,epsiloncookie,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,epsiloncookie,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Fri, 20 Sep 2024 13:15:09 GMT
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: ap-northeast-1c

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 634 B
606 B 71ms
37ms Fetch
application/json 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 8aa55e23264576a3203c911220c574fe36367136dbdc755c10dc6224767c4eb5

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
EpsilonCookie: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-encoding: gzip
x-6si-region: ap-northeast-1c
access-control-allow-credentials: true
access-control-allow-origin: https://www.fortinet.com
content-length: 320
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/json
vary: Origin, Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
103 KB 115ms
96ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

88271145afa467c5e2f2391754e9a01d967855a789f3b75e8b677298a7659ad3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:09 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104876
date: Fri, 20 Sep 2024 13:15:09 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 clock Show response
tracking.crazyegg.com/ 40 B
147 B 195ms
53ms XHR
text/plain 43.202.117.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?t=1&tk=329ee1373036c5ddcda74cf257baa0a6&u=1170786&s=424000&p=%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v=ef47407801207ad301cf37bdc27a935e41dd21a8&f=fortinet.com%2Fblog%2Fthreat-research%2F*&ul=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.202.117.154 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-202-117-154.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 83696e40fbfd1571ed67e2350fee62e221fc85b136050b49a6802f6aab8bf704

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store
access-control-allow-origin: *
content-length: 40
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: text/plain
server: awselb/2.0

GET 9722a1c6-815f-4f06-bff2-64def4414d6d
https://www.fortinet.com/ Frame 0
0

GET
H2 200 s21572567098849
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/ 43 B
388 B 111ms
10ms Image
image/gif 63.140.50.233
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/s21572567098849?AQB=1&ndh=1&pf=1&t=20%2F8%2F2024%2022%3A15%3A9%205%20-540&sdid=2048EECF38E93931-30FE768A839B636E&mid=81645950242206795952505284693039732777&aamlh=11&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Athreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&c7=Entire%20Site&c8=New&v25=81645950242206795952505284693039732777&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Athreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v106=Voluntari&v107=Ilfov&v108=Romania&v126=NA&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.50.233 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

etag: 3708356604440444928-4618519436028807152
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:15:10 GMT
p3p: CP="This is not a P3P policy"
date: Fri, 20 Sep 2024 13:15:10 GMT
last-modified: Sat, 21 Sep 2024 13:15:10 GMT
vary: *
x-adobe-ingress: hp
content-type: image/gif;charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
pragma: no-cache
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block
server: jag

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 186ms
173ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=ni%3Aepsv&q=%7B%22or%22%3A%22ap-northeast-1a%22%2C%22nr%22%3A%22ap-northeast-1c%22%2C%22orl%22%3A185%2C%22nrl%22%3A166%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22RO%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22RO%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22company_match%5C%22%3A%5C%22No%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22No%20company%20name%20or%20domain%20was%20found%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22match%22%3Afalse%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:10 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
519 B 607ms
594ms XHR
application/json 13.225.183.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.183.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-183-12.nrt57.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.fortinet.com/

Response headers

x-amz-apigw-id: eZ9G5GN0oAMEQGg=
x-amzn-trace-id: Root=1-66ed755f-715741451622b19d5869910e;Parent=1e6962c1dc32edfc;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 11ca3cf6-d6ed-4c6e-8336-79dcdedf8444
via: 1.1 09fd24f6a1b0ff1b7cd860a75335700c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: 8oC4ut0A5bdyK8sBs2NEruvz5PRaCLLFr9mWGV2dAtHjj7Eb64eXSw==
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/json
x-amz-cf-pop: NRT57-C4
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 175ms
164ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A8977.099999904633%2C%22duration%22%3A164.60000038146973%2C%22initiatorType%22%3A%22fetch%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A8977.099999904633%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A9141.700000286102%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22ap-northeast-1c%22%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22RO%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22RO%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22company_match%5C%22%3A%5C%22No%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22No%20company%20name%20or%20domain%20was%20found%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=&d=1&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:10 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 564ms
505ms Preflight
application/json 13.225.183.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.183.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-183-12.nrt57.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Fri, 20 Sep 2024 13:15:10 GMT
via: 1.1 09fd24f6a1b0ff1b7cd860a75335700c.cloudfront.net (CloudFront)
x-amz-apigw-id: eZ9G0HspIAMEFMQ=
x-amz-cf-id: i3W4ND4SqDarmPNfRpS6pf_4IXxVBp_Co-MbiBJDmNzeX1Z2b_kLjQ==
x-amz-cf-pop: NRT57-C4
x-amzn-requestid: 3986ccd5-03de-435c-9626-09cd558aa50c
x-cache: Miss from cloudfront

GET
H3 200 ca6be1649b2c6bd5aa79ebaa229fa676.js Show response
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ 20 KB
8 KB 42ms
39ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ca6be1649b2c6bd5aa79ebaa229fa676.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7701282ea59743a1d336ee5ede4e6805ca9572c28ad013fa956fb39f18de0d69

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1063
cf-ray: 8c62152c7f497379-NRT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: text/javascript
last-modified: Wed, 18 Sep 2024 13:30:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 251 KB
88 KB 99ms
99ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

66a4281a7684239d0eaeb9e42ad71f249a5a452e286acdb9f99040797ff6fb15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 90477
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 113ms
112ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ed25439a95a5e80366491d61110058073f12ee6e7d8819eab0bd2f84b73ff369

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79027
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 231 KB
83 KB 97ms
95ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

4e087b4fdf2d01e82e172c013dadf27dd879737dd595df92fa435f4662538d51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 85155
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
86 KB 93ms
92ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c2cd52aef52bd7a14d5e8b101e3e6c969f35eb4f1ddab97290edddf4c8416f84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 88165
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 128ms
68ms Fetch
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-38BQ9XFDT4&gtm=45je49j0v9191763579za200&_p=1726838109356&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101529666~101533421&cid=1827021750.1726838110&ul=ja-jp&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726838110&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&dt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=9485
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 51 KB
18 KB 35ms
6ms Script
application/javascript 2400:52e0:1501::1193:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1501::1193:1 , Japan, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-JP1-1193 /
Resource Hash: ab5b000d7c8c84f2cc6dbaacd88498126fa4b2fcb04cf14ae9fcd8eef9623760

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"66e2dd78-cca5"
cdn-fileserver: 869
date: Fri, 20 Sep 2024 13:15:10 GMT
cdn-storageserver: JP-394
last-modified: Thu, 12 Sep 2024 12:24:24 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 09/19/2024 20:09:41
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 5758963c376cb6b6c6ad17fad2362922
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 1184
server: BunnyCDN-JP1-1193
cdn-requestcountrycode: JP

GET
H3 200 9ca7c9e85a6ce51bd9b80280f971319a.js Show response
script.crazyegg.com/pages/versioned/tracking-scripts/ 95 KB
31 KB 37ms
35ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/tracking-scripts/9ca7c9e85a6ce51bd9b80280f971319a.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: daaa79b81fa49a10852df79446783b9c51de167ee31aaff722e030c6cacc674b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1066
cf-ray: 8c62152dd9197379-NRT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: text/javascript
last-modified: Mon, 16 Sep 2024 20:30:38 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 api.min.css
a.omappapi.com/app/js/ 10 KB
3 KB 98ms
8ms Stylesheet
text/css 2400:52e0:1501::1193:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1501::1193:1 , Japan, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-JP1-1193 /
Resource Hash: 71e3c0057bec6dab5d49a1b6994c8e4fffa97614ba115bc8747a2be7c43ed048

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"66e2dd79-2644"
cdn-fileserver: 681
date: Fri, 20 Sep 2024 13:15:10 GMT
cdn-storageserver: JP-394
last-modified: Thu, 12 Sep 2024 12:24:25 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 09/19/2024 20:09:41
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 94a35a031125bb4acb669f4d9d64ee43
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 1185
server: BunnyCDN-JP1-1193
cdn-requestcountrycode: JP

GET
H2 401 39852 Show response
api.omappapi.com/v2/embed/ 165 B
595 B 297ms
203ms XHR
application/json 2606:4700:3108::ac42:2af8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2af8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-user-agent: standard--
cf-cache-status: DYNAMIC
expires: Fri, 20 Sep 2024 13:16:10 GMT
x-cache: Error from cloudfront
x-amz-cf-id: tYHQvIYleUIplDZJYHHDm8XyEILMQlYClMNEonwakQySRCg_UvH2RA==
date: Fri, 20 Sep 2024 13:15:10 GMT
x-cache-config: 0 0
content-type: application/json
vary: Accept-Encoding, User-Agent
access-control-allow-headers: X-CSRF-Token
cache-control: public, max-age=120, stale-while-revalidate=1800
via: 1.1 3bf00a4dd6a940e1f87d382806e0bd00.cloudfront.net (CloudFront)
cf-ray: 8c62152edd10af28-NRT
access-control-allow-origin: *
content-length: 165
x-amz-cf-pop: NRT57-P3
server: cloudflare

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 193ms
100ms Script
text/javascript 2606:4700::6812:1347
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1347 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 48423
via: 1.1 google
cf-ray: 8c62152edd697344-NRT
expires: Fri, 20 Sep 2024 13:35:10 GMT
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK tag.js Show response
abm-tracking.demandscience.com/ 2 KB
2 KB 401ms
116ms Script
application/javascript 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/tag.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: public, max-age=0
ETag: W/"82b-18f5d3a3d78"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2091
Date: Fri, 20 Sep 2024 13:15:10 GMT
Content-Type: application/javascript; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Thu, 09 May 2024 12:00:49 GMT

GET
H2 200 wid.tracker.js Show response
tmp.argusplatform.com/js/ 8 KB
3 KB 259ms
200ms Script
text/javascript 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://tmp.argusplatform.com/js/wid.tracker.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preloadmax-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preloadmax-age=31536000
cache-control: public, must-revalidate, max-age=30
x-dns-prefetch-control: off
content-encoding: br
etag: "28476869"
referrer-policy: same-origin
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:10 GMT
x-xss-protection: 1; mode=block
content-type: text/javascript
last-modified: Sat, 08 Jun 2024 11:51:22 GMT
vary: Accept-Encoding
x-azure-ref: 20240920T131510Z-r1677749c86v7wjlqgfb9dw2ns0000000130000000016znc

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ 161 B
711 B 527ms
173ms Script
text/javascript 74.121.140.211
PAEDAE-INC

General

Check archive.org

Show headers Download Go to

Full URL

https://pixel.mathtag.com/event/js?mt_id=1629896&mt_adid=260855&mt_exem=&mt_excl=&v2=&v3=&s1=&s2=&s3=&v1=en:blog:threat-research:threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.121.140.211 Reston, United States, ASN30419 (PAEDAE-INC, US),

Reverse DNS

Software

MT3 1668 f41eadd master iad iad-pixel-x4 config_version:"2232" /

Resource Hash

98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457

Security Headers

Name	Value
Strict-Transport-Security	31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Strict-Transport-Security: 31536000
Cache-Control: no-cache
Content-Encoding: gzip
Connection: close
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Fri, 20 Sep 2024 13:15:10 GMT
X-XSS-Protection: 0
Content-Type: text/javascript
Server: MT3 1668 f41eadd master iad iad-pixel-x4 config_version:"2232"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 316 KB
105 KB 119ms
109ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f1d0599a803eb0bc984213e78d9f0ad1cefb2969b1fff4862df9ee0927d20df1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:10 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106998
date: Fri, 20 Sep 2024 13:15:10 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H/1.1 200
OK footer-links.json Show response
www.fortinet.com/content/dam/fortinet-blog/ 310 KB
36 KB 185ms
77ms XHR
application/json 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/footer-links.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "4d8dc-61d89b0f78340-gzip"
Age: 5511002
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: GZGYurNYz0nMBj-NNdRQcRtEnS0gv7PNtxDaWQwkt1E20nYx-_GUrg==
Date: Fri, 20 Sep 2024 01:13:59 GMT
Content-Type: application/json
Vary: Accept-Encoding
Last-Modified: Thu, 18 Jul 2024 18:24:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 f626414885b2faf7a229c7fb2778d5c8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35378
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

POST
H2 201 v11 Show response
tracking.crazyegg.com/ 0
82 B 112ms
90ms XHR
text/plain 43.202.117.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.202.117.154 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-202-117-154.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/gzip
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: text/plain
server: awselb/2.0

OPTIONS
H2 204 v11
tracking.crazyegg.com/ Frame 0
0 62ms
56ms Preflight 43.202.117.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.202.117.154 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-202-117-154.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public, max-age=86400
date: Fri, 20 Sep 2024 13:15:10 GMT
server: awselb/2.0
vary: Access-Control-Request-Headers, Origin, Access-Control-Request-Method

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 174ms
168ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A10%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A09%20GMT%22%2C%22timeSpent%22%3A%221068%22%2C%22totalTimeSpent%22%3A%221068%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:10 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 activityi;fledge=1;src=10050195;npa=0;auiddc=1128146875.1726838110;ps=1;pcor=1425848075;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=...
td.doubleclick.net/td/fls/rul/ Frame 016A 0
0 102ms
46ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=1128146875.1726838110;ps=1;pcor=1425848075;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;src=10050195;npa=0;auiddc=1128146875.1726838110;ps=1;pcor=1425848075;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1...
ad.doubleclick.net/ 42 B
65 B 92ms
42ms Image
image/gif 172.217.26.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;src=10050195;npa=0;auiddc=1128146875.1726838110;ps=1;pcor=1425848075;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.26.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Fri, 20 Sep 2024 13:15:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET activity;register_conversion=1;src=10050195;npa=0;auiddc=1128146875.1726838110;ps=1;pcor=1425848075;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb912...
ad.doubleclick.net/ 0
0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 6 KB
2 KB 100ms
54ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1726838110705&cv=11&fst=1726838110705&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

1a962d2b05e2b420f94ab50069ec3028684b7955343965459ab1c81bca368e9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2390
date: Fri, 20 Sep 2024 13:15:10 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 609297413
td.doubleclick.net/td/rul/ Frame A508 0
0 109ms
108ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/609297413?random=1726838110705&cv=11&fst=1726838110705&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/ 6 KB
2 KB 53ms
53ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/?random=1726838110786&cv=11&fst=1726838110786&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

013f12ee268cd0ef9687049ee36ea1abb72a5c1db557ed6bfb5cc6a9ba30d018

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2411
date: Fri, 20 Sep 2024 13:15:10 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 729495989
td.doubleclick.net/td/rul/ Frame 4782 0
0 105ms
104ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/729495989?random=1726838110786&cv=11&fst=1726838110786&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 6 KB
2 KB 54ms
53ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1726838110868&cv=11&fst=1726838110868&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

a64c1f9973cb3883a133e383d544adad0468de8e85a2bdb61187dbecca9864b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2428
date: Fri, 20 Sep 2024 13:15:10 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 662878185
td.doubleclick.net/td/rul/ Frame 26B8 0
0 119ms
115ms Document
text/html 172.217.161.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/662878185?random=1726838110868&cv=11&fst=1726838110868&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.161.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s23-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
440 B 177ms
174ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1726838110970&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
ibc_rate_tier: 1247773
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Fri, 20 Sep 2024 14:15:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AD-8ljvT-g_zL-A3ZFsaQzN_Y-XOsG4cvYu7t6L-OYzncq2-iO_uQilcgpyzd29EFuSrcE6EbCc
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 178ms
162ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1726838110970&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 20 Sep 2024 13:15:11 GMT
expires: Fri, 20 Sep 2024 13:15:11 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AD-8ljuVSUKHXA69EcB70vi7_E2TmzYEbeyAT5245GQZ-mEKF1aOikkSkVDxNN2xECdTiZoXHsk

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 42ms
39ms Fetch
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-JH142QCQCJ&gtm=45je49j0v893708426za200zb9123037237&_p=1726838109356&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=1827021750.1726838110&ul=ja-jp&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726838111&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&dt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_ss=1&_ee=1&tfd=10174
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: text/plain
server: Golfe2

GET
H2 401 / Show response
pixels.argusplatform.com/wh/track/ 205 B
467 B 980ms
941ms XHR
application/json 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838111001783255&event_type=page_request&timestamp=1726838111&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:12 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20240920T131511Z-r1677749c86jx5ts5cs4cu6e4s0000000btg00000001m6wt

GET
H3 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
64 B 99ms
41ms Image
image/gif 142.251.222.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1726838110705&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfLyg8n_3M28g2HrThyjCV_hgDi3Ub1A&random=2955227076&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.222.36 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt13s72-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/609297413/ 42 B
64 B 121ms
56ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/609297413/?random=1726838110705&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfLyg8n_3M28g2HrThyjCV_hgDi3Ub1A&random=2955227076&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 fp.min.js Show response
cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/ 33 KB
15 KB 29ms
3ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY"
age: 13675
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220049-FRA, cache-tyo11976-TYO
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15023
x-jsd-version: 3.4.2

GET
H2 200 site-visitors Show response
intentstream.contanuity.com/api/ 115 B
374 B 132ms
132ms Fetch
application/json 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-pixel-auth: true
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=15724800; includeSubdomains
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 115
date: Fri, 20 Sep 2024 13:11:36 GMT
content-type: application/json; charset=utf-8
vary: origin
server: nginx

GET
H3 200 /
www.google.com/pagead/1p-user-list/729495989/ 42 B
64 B 90ms
42ms Image
image/gif 142.251.222.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/729495989/?random=1726838110786&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfGccnLooNOCX3RPGfxyvDEtPBH7Be1i-Y5kyQQkc-RuysY9Gx&random=2498696060&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.222.36 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt13s72-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/729495989/ 42 B
64 B 113ms
57ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/729495989/?random=1726838110786&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfGccnLooNOCX3RPGfxyvDEtPBH7Be1i-Y5kyQQkc-RuysY9Gx&random=2498696060&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/662878185/ 42 B
64 B 91ms
44ms Image
image/gif 142.251.222.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/662878185/?random=1726838110868&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfMlqZwXSc6ObcEoIKOKFJNZZ7BM5DorR9w1SQD0EvRqoqsTFP&random=2622807708&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.222.36 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt13s72-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/662878185/ 42 B
64 B 113ms
57ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/662878185/?random=1726838110868&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1128146875.1726838110&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfMlqZwXSc6ObcEoIKOKFJNZZ7BM5DorR9w1SQD0EvRqoqsTFP&random=2622807708&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

OPTIONS
H2 200 site-visitors
intentstream.contanuity.com/api/ Frame 0
0 397ms
129ms Preflight 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-pixel-auth
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-pixel-auth
access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
content-length: 0
date: Fri, 20 Sep 2024 13:11:36 GMT
server: nginx
strict-transport-security: max-age=15724800; includeSubdomains

GET
H2 200 RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
1015 B 8ms
1ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: af89d0f65e1c53f2831c1b73f25ee3053fddc6551962dc58eada982a2fd99bdd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 758
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7be3d22b2fd6487ca9390477738587fe-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
756 B 8ms
2ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC7be3d22b2fd6487ca9390477738587fe-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 59d12a10e99345ccbe1776752be1dcab5d337248fb1f523fb3cf93ffecf3a779

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC407b573180554ea6b11eecdc31ecbd3f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
756 B 8ms
2ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC407b573180554ea6b11eecdc31ecbd3f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2d0ddcf9662d44f133470ee7c926c568e540874718195167d7ce2eae31839a2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC1d92f04752ae42a38e54de48cb85adf4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 661 B
648 B 8ms
3ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC1d92f04752ae42a38e54de48cb85adf4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4b1017ddd583b8790466a28987a1dabd2d750fcbc0dbffbf263bee2e4cd35791

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 391
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf940460311f349b5af69d075bdef61d4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 368 B
492 B 9ms
4ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCf940460311f349b5af69d075bdef61d4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 956915db9ed8f96ac4ee123a7909637e7db25f3ea20e41927c5fcc4fd50108ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 235
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 754 B
704 B 8ms
3ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a57c6cd6129a6ae679af72011e4529d2c322ff41ca4933dedd76150ffcae369

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 447
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
971 B 15ms
10ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 73ade03dfeae221bb318514f70aa5ae9c9c653b6871008ef9a3596f9255a78f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 714
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1021 B
857 B 14ms
9ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ee555b56d11e10b0a60e50d84be13221d318b328d16a7b59d77bb5dc7007e4d2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 601
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcd84e40d19c24776bef77836ab2f8df6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
758 B 13ms
9ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 7a520fb2812687266f06520e650deb9dece37e49629623c4be612b1f561e11df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 502
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 388 B
498 B 11ms
7ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8dbdd526d3da8b4924bc169cb3faee88cda6da11742ef935ae2e916a17b7d978

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 242
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5c60a51709a94068afbf065e1448b617-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 664 B
657 B 13ms
10ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC5c60a51709a94068afbf065e1448b617-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 88a5f8b5bcd4b32ed398b199bfc0ecf20ba41bf544d2ca04bc40111db7c66ab3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 401
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7675832323134b109ff7c59296e2d2ca-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1 KB
797 B 16ms
12ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC7675832323134b109ff7c59296e2d2ca-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d04f03c209c8b79223d1147dec2771c3e87a401dc1348b7dd10de0aa7d22297f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 540
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
981 B 17ms
14ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8109fbd42099eef3aed0564d81e4502bade4a64b6bd5174894f0f1e8019cd421

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 724
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 966 B
809 B 11ms
7ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bb50d0022dac04a6c6a2fc5edf927a4682c8e6b73a970546c75ff118f06ad4e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:11 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 552
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 p Show response
i.simpli.fi/ 798 B
762 B 84ms
68ms Script
application/javascript 34.87.122.136
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp
Requested by: Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.87.122.136 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 136.122.87.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: 6159fa98f5205e8f16d20648687e1f31878ae2e7c0496bc1788c737e019ae57f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: openresty

GET
H/1.1 200
OK favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/ 318 B
2 KB 77ms
76ms Other
image/vnd.microsoft.icon 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "13e-565c628eb6a00-gzip"
Age: 6105646
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: eY-8ArCtPe6RoOFWqp-ph5SodJhHLQWYPxzJQu0eKnMbBOQbRnt8DA==
Date: Fri, 20 Sep 2024 13:15:06 GMT
Content-Type: image/vnd.microsoft.icon
Last-Modified: Thu, 22 Feb 2018 05:17:28 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 503185d30898f0ec9039d4166605804a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 133
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK spx Show response
dx.mountain.com/ 23 KB
6 KB 464ms
118ms Script
application/javascript 54.190.217.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=33628795205177676term=value
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 54.190.217.118 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-190-217-118.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 6cea900299a995ce31b2ad62fde2b400c6886f61301debf651e246b251fc1f13

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 2
connection: close
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/javascript;charset=utf-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: istio-envoy

GET
BLOB 200
OK 9136eff2-b855-4844-9b7c-91881520151c
https://www.fortinet.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.fortinet.com/9136eff2-b855-4844-9b7c-91881520151c
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 11ms
2ms Script
application/javascript 151.101.228.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.228.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Fri, 20 Sep 2024 13:15:11 GMT
x-tw-cdn: FT
last-modified: Wed, 27 Mar 2024 23:09:36 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kiad7000135-IAD, cache-hnd18729-HND
x-amz-server-side-encryption: AES256

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1773420&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

43 B
1 KB

77ms
76ms

Image
image/gif

103.43.90.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Protocol

Server

103.43.90.19 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.201.218; 146.70.201.218; 595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: abb45ae9-63b9-44b1-93f6-65dfbd234847
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 146.70.201.218; 146.70.201.218; 595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 2e811b6c-ac75-45df-a0ad-8c9cfd56679a
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?add=36113683
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

43 B
1 KB

77ms
76ms

Image
image/gif

103.43.90.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Protocol

Server

103.43.90.117 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.201.218; 146.70.201.218; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: fb5a906e-9fa9-49f2-af27-866c65c2c03c
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.201.218; 146.70.201.218; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 162dc4a4-b63b-4af2-9595-4cdc81fd47bf
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 iztag.js Show response
tags.inzynk.io/0ulh3gex/ 34 B
443 B 19ms
4ms Script
application/octet-stream 2600:9000:2751:3600:12:dfa9:e200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.inzynk.io/0ulh3gex/iztag.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2751:3600:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding
x-amz-version-id: 15XT7F8rursoJ6jHrhKIXrYdXTZkWasY
etag: "595f7fa79bc22a7029d2751228622eb4"
age: 57787
via: 1.1 8d674b0dbbb3efae2c2364b57d734a54.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 34
x-amz-cf-id: 0R6gGt_c8zwinJHMfFi7xUrb7DIJH9QNURFp5XVWPp9NG4DQZhM8_w==
date: Thu, 19 Sep 2024 21:12:21 GMT
content-type: application/octet-stream
last-modified: Thu, 05 Sep 2024 13:11:02 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P2
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Show response
abm-tracking.demandscience.com/page-tracking/fortinet_2712/ 2 B
665 B 115ms
115ms Script
application/json 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/page-tracking/fortinet_2712/https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?visitorId=d13d32f58501fd8aea71a13fdffce4b8_1726838111391&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 20 Sep 2024 13:15:11 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 200 adsct
t.co/i/ 43 B
471 B 162ms
141ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=5c51b684-ca0c-4d11-b8c2-be84ea4ca651&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=db8be479-6697-401b-a3f4-ef2e38fe9333&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 29f8a60d9931c565
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 15bddc11c9e2d07860b63f38840d96a7ae331948c8dc81f2246eeb69df7ef81f
cf-cache-status: DYNAMIC
cf-ray: 8c6215346d9c5c8b-NRT
x-response-time: 97
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
395 B 120ms
101ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=5c51b684-ca0c-4d11-b8c2-be84ea4ca651&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=db8be479-6697-401b-a3f4-ef2e38fe9333&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 4794147f31f06f45
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 7aed5c3edac584fdf622d8a01b9d6f78a6514538d54eceec19b19476bd554ce2
x-response-time: 98
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H2 200 adsct
t.co/i/ 43 B
632 B 160ms
140ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=104507e6-4860-42e0-a307-a97843e33ed8&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=db8be479-6697-401b-a3f4-ef2e38fe9333&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 2c45bd7581fde932
cache-control: no-cache, no-store, max-age=0
x-connection-hash: a092c7fc7899230652478df8a5dd7761c1b0616ccf1b297bbc2647962a480d59
cf-cache-status: DYNAMIC
cf-ray: 8c6215346d9a5c8b-NRT
x-response-time: 110
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
238 B 123ms
105ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=104507e6-4860-42e0-a307-a97843e33ed8&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=db8be479-6697-401b-a3f4-ef2e38fe9333&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 0fc8bfa21e42df75
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 7aed5c3edac584fdf622d8a01b9d6f78a6514538d54eceec19b19476bd554ce2
x-response-time: 100
content-length: 43
date: Fri, 20 Sep 2024 13:15:10 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H3

200

receive
pixel.tapad.com/idsync/ex/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=48DDDBD30D29424C9F8B3A3C69A6314A
https://pixel.tapad.com/idsync/ex/receive?partner_id=3372&partner_device_id=0fa13d61a2
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3372&partner_device_id=0fa13d61a2
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=a2de8d86-8e04-4b40-af2d-13933b7e67a5%252C%252C&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=a2de8d86-8e04-4b40-af2d-13933b7e67a5%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=bac5e4e8-f265-4612-81ef-59735c488a2c&ttd_puid=a2de8d86-8e04-4b40-af2d-13933b7e67a5%2C%2C

95 B
124 B

43ms
43ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=bac5e4e8-f265-4612-81ef-59735c488a2c&ttd_puid=a2de8d86-8e04-4b40-af2d-13933b7e67a5%2C%2C

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=bac5e4e8-f265-4612-81ef-59735c488a2c&ttd_puid=a2de8d86-8e04-4b40-af2d-13933b7e67a5%2C%2C
content-length: 359
date: Fri, 20 Sep 2024 13:15:11 GMT
server: Kestrel

GET
H2

200

RX-1e42aa08-ea35-4aa3-936f-e89fa4a94768-004
sync.targeting.unrulymedia.com/csync/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/48DDDBD30D29424C9F8B3A3C69A6314A
https://sync.1rx.io/usersync/simplifi/48DDDBD30D29424C9F8B3A3C69A6314A?zcc=1&cb=1726838111743
https://sync.targeting.unrulymedia.com/csync/RX-1e42aa08-ea35-4aa3-936f-e89fa4a94768-004

43 B
378 B

149ms
49ms

Image
image/gif

74.118.186.107
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-1e42aa08-ea35-4aa3-936f-e89fa4a94768-004
Protocol: H2
Server: 74.118.186.107 Serangoon New Town, Singapore, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Fri, 20 Sep 2024 13:15:11 GMT
content-length: 43

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://sync.targeting.unrulymedia.com/csync/RX-1e42aa08-ea35-4aa3-936f-e89fa4a94768-004
date: Fri, 20 Sep 2024 13:15:11 GMT
pragma: no-cache
content-type: text/html

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=48DDDBD30D29424C9F8B3A3C69A6314A&dongle=yf3
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=48DDDBD30D29424C9F8B3A3C69A6314A&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

37 B
474 B

71ms
71ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=48DDDBD30D29424C9F8B3A3C69A6314A&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: /xuid?ld=1&mid=7969&xuid=48DDDBD30D29424C9F8B3A3C69A6314A&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 20 Sep 2024 13:15:11 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=48DDDBD30D29424C9F8B3A3C69A6314A

43 B
175 B

511ms
169ms

Image
image/gif

2600:1f18:612b:4200:439f:77e3:80bf:81be
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=48DDDBD30D29424C9F8B3A3C69A6314A
Protocol: H2
Server: 2600:1f18:612b:4200:439f:77e3:80bf:81be Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Fri, 20 Sep 2024 13:15:12 GMT
content-type: image/gif
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://simplifi.partners.tremorhub.com/sync?UISF=48DDDBD30D29424C9F8B3A3C69A6314A
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:11 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=48DDDBD30D29424C9F8B3A3C69A6314A
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=48DDDBD30D29424C9F8B3A3C69A6314A

95 B
427 B

43ms
41ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=48DDDBD30D29424C9F8B3A3C69A6314A

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=48DDDBD30D29424C9F8B3A3C69A6314A
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Fri, 20 Sep 2024 13:15:11 GMT
server: Jetty(11.0.13)

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=48DDDBD30D29424C9F8B3A3C69A6314A
https://d.agkn.com/pixel/10751/?che=1726838111664&ip=146.70.201.218&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D232903305011003804456
https://um.simpli.fi/aa_px?sk=232903305011003804456
https://um.simpli.fi/empty.gif

43 B
361 B

70ms
70ms

Image
image/gif

34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
location: /empty.gif
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=48DDDBD30D29424C9F8B3A3C69A6314A
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=48DDDBD30D29424C9F8B3A3C69A6314A&ckls=true&ci=MiBsknZbMz&nc=false&trid=1480368170

43 B
1 KB

182ms
179ms

Image
image/gif

3.164.110.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=48DDDBD30D29424C9F8B3A3C69A6314A&ckls=true&ci=MiBsknZbMz&nc=false&trid=1480368170
Protocol: H2
Server: 3.164.110.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-110-92.nrt12.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 d694eac03cd6dc48a34be10ef919bdd4.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
x-amz-cf-pop: NRT12-P2
x-amz-cf-id: MNJrU9rZ4l3nJQnhYu37JetLCrJ_N5NnaPvV40Tsgn0sIh9buTlggQ==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=48DDDBD30D29424C9F8B3A3C69A6314A&ckls=true&ci=MiBsknZbMz&nc=false&trid=1480368170
pragma: no-cache
via: 1.1 d694eac03cd6dc48a34be10ef919bdd4.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
x-amz-cf-pop: NRT12-P2
x-amz-cf-id: aCQcaDcqRor_jpSIs47GwPp6h-GpObcxA45_YesZTYF-_IUevmnB4g==

GET
H2 200 pubmatic
um.simpli.fi/ 43 B
409 B 80ms
71ms Image
image/gif 34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:11 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 freewheel
um.simpli.fi/ 43 B
409 B 129ms
120ms Image
image/gif 34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/freewheel

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:11 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

getuid
sync.smartadserver.com/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=48DDDBD30D29424C9F8B3A3C69A6314A;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=48DDDBD30D29424C9F8B3A3C69A6314A;mimetype=img;sr
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Ffei.pro-market.net%2Fengine%3Fsite%3D161185%26size%3D1x1%26du%3D36%26csync%3D[sas_uid]
https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1

0
316 B

80ms
80ms

Image
text/plain

23.106.127.57
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
Protocol: HTTP/1.1
Server: 23.106.127.57 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD., SG),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 20 Sep 2024 13:15:11 GMT
pragma: no-cache

Redirect headers

cache-control: no-cache,no-store
location: https://sync.smartadserver.com:443/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 20 Sep 2024 13:15:12 GMT
pragma: no-cache

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=48DDDBD30D29424C9F8B3A3C69A6314A&j=0
https://loadm.exelator.com/load/?p=204&g=2191&simid=48DDDBD30D29424C9F8B3A3C69A6314A&j=0&xl8blockcheck=1

0
2 KB

850ms
850ms

Image
text/plain

34.229.3.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=48DDDBD30D29424C9F8B3A3C69A6314A&j=0&xl8blockcheck=1
Protocol: H2
Server: 34.229.3.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-229-3-43.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 20 Sep 2024 13:15:13 GMT
x-powered-by: Undertow/1
server: nginx
access-control-allow-credentials: true

Redirect headers

cache-control: no-cache
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=48DDDBD30D29424C9F8B3A3C69A6314A&j=0&xl8blockcheck=1
access-control-allow-credentials: true
content-length: 0
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 20 Sep 2024 13:15:12 GMT
content-type: image/gif
x-powered-by: Undertow/1
server: nginx

GET
H2 200 yahoo
um.simpli.fi/ 43 B
409 B 128ms
119ms Image
image/gif 34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/yahoo

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:11 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=48DDDBD30D29424C9F8B3A3C69A6314A

0
421 B

694ms
176ms

Image
text/plain

52.23.38.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=48DDDBD30D29424C9F8B3A3C69A6314A
Protocol: HTTP/1.1
Server: 52.23.38.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-23-38-239.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Date: Fri, 20 Sep 2024 13:15:11 GMT
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.bfmio.com/sync?pid=141&uid=48DDDBD30D29424C9F8B3A3C69A6314A
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:11 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=48DDDBD30D29424C9F8B3A3C69A6314A

62 B
445 B

177ms
161ms

Image
image/gif

23.36.17.70
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=48DDDBD30D29424C9F8B3A3C69A6314A
Protocol: H2
Server: 23.36.17.70 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-17-70.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
content-length: 62
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://stags.bluekai.com/site/29931?id=48DDDBD30D29424C9F8B3A3C69A6314A
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:11 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

tpid=48DDDBD30D29424C9F8B3A3C69A6314A
bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=48DDDBD30D29424C9F8B3A3C69A6314A
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=48DDDBD30D29424C9F8B3A3C69A6314A

49 B
265 B

78ms
77ms

Image
image/gif

52.74.120.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=48DDDBD30D29424C9F8B3A3C69A6314A
Protocol: H2
Server: 52.74.120.137 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-74-120-137.ap-southeast-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
x-server: 10.42.31.200
server: Jetty(9.4.38.v20210224)

Redirect headers

cache-control: no-cache
location: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=48DDDBD30D29424C9F8B3A3C69A6314A
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 20 Sep 2024 13:15:11 GMT
x-server: 10.42.6.195
server: Jetty(9.4.38.v20210224)

GET
H2

200

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=48DDDBD30D29424C9F8B3A3C69A6314A
https://ce.lijit.com/merge?pid=2&3pid=48DDDBD30D29424C9F8B3A3C69A6314A&dnr=1

43 B
511 B

115ms
115ms

Image
image/gif

35.82.115.140
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=48DDDBD30D29424C9F8B3A3C69A6314A&dnr=1
Protocol: H2
Server: 35.82.115.140 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-82-115-140.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 20 Sep 2024 13:15:12 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://ce.lijit.com/merge?pid=2&3pid=48DDDBD30D29424C9F8B3A3C69A6314A&dnr=1
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 20 Sep 2024 13:15:12 GMT
vary: Accept-Encoding

GET
H3

200

362358.gif
idsync.rlcdn.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=48DDDBD30D29424C9F8B3A3C69A6314A
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogNDhERERCRDMwRDI5NDI0QzlGOEIzQTNDNjlBNjMxNEEQABoNCN_qtbcGEgUI6AcQAEIASgA
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEEMZC_G7ZpdPytOJodaAbkI&google_cver=1

42 B
59 B

161ms
161ms

Image
image/gif

35.244.154.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEEMZC_G7ZpdPytOJodaAbkI&google_cver=1
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Fri, 20 Sep 2024 13:15:12 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEEMZC_G7ZpdPytOJodaAbkI&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 289
date: Fri, 20 Sep 2024 13:15:12 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

/
www.google.co.jp/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1726838111356&cv=7&fst=1726838111356&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=217406891&cv=7&fst=1726838111356&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHB...
https://www.google.com/pagead/1p-conversion/1026675585/?random=217406891&cv=7&fst=1726838111356&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDs...
https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=217406891&cv=7&fst=1726838111356&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLH...

42 B
64 B

58ms
57ms

Image
image/gif

142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=217406891&cv=7&fst=1726838111356&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjrxrECCJvHsQI&pscrd=IhMI44fqoc3RiAMVMofpBR3OSSRlMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSLADpaXnfL5wa_2cKT97GlvkbRgDIiZ27ur3pgneSeRwuCZbVbGSRMOMVCWab&random=2776063906&ipr=y

Protocol

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=217406891&cv=7&fst=1726838111356&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjrxrECCJvHsQI&pscrd=IhMI44fqoc3RiAMVMofpBR3OSSRlMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSLADpaXnfL5wa_2cKT97GlvkbRgDIiZ27ur3pgneSeRwuCZbVbGSRMOMVCWab&random=2776063906&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 126ms
121ms Image
text/plain 34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:11 GMT
x-content-type-options: nosniff

GET
H2

200

setuid
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=48DDDBD30D29424C9F8B3A3C69A6314A

43 B
1 KB

80ms
72ms

Image
image/gif

103.43.90.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=66&code=48DDDBD30D29424C9F8B3A3C69A6314A

Protocol

Server

103.43.90.117 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 146.70.201.218; 146.70.201.218; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 1b895b75-69b5-46bb-bdc8-2cf31be9591f
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ib.adnxs.com/setuid?entity=66&code=48DDDBD30D29424C9F8B3A3C69A6314A
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:11 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=48DDDBD30D29424C9F8B3A3C69A6314A&expires=365

42 B
1 KB

288ms
73ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=48DDDBD30D29424C9F8B3A3C69A6314A&expires=365
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d335433bbbe0efeac67146df47932f6f
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=48DDDBD30D29424C9F8B3A3C69A6314A&expires=365
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:11 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=48DDDBD30D29424C9F8B3A3C69A6314A

43 B
264 B

53ms
39ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072966&val=48DDDBD30D29424C9F8B3A3C69A6314A
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
vary: Accept
server: OXGW/0.0.0

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://us-u.openx.net/w/1.0/sd?id=537072966&val=48DDDBD30D29424C9F8B3A3C69A6314A
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:11 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_gid=CAESEMybglbkbSDT5xPuA_fQkp8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=48DDDBD30D29424C9F8B3A3C69A6314A
https://um.simpli.fi/g_match?id=

0
320 B

71ms
71ms

Image
text/plain

34.124.209.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=

Protocol

Server

34.124.209.251 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.209.124.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:15:11 GMT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:11 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

cache-control: no-cache, must-revalidate
location: https://um.simpli.fi/g_match?id=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 229
date: Fri, 20 Sep 2024 13:15:11 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4123233115907.0103
10104846.fls.doubleclick.net/activityi;dc_pre=CLPg4KHN0YgDFfdZDwIdrmoEgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/ Frame 7A0B
Redirect Chain

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;d...
https://10104846.fls.doubleclick.net/activityi;dc_pre=CLPg4KHN0YgDFfdZDwIdrmoEgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoser...

0
0

51ms
50ms

Document
text/html

172.217.26.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10104846.fls.doubleclick.net/activityi;dc_pre=CLPg4KHN0YgDFfdZDwIdrmoEgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4123233115907.0103?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.26.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 2246
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:11 GMT
expires: Fri, 20 Sep 2024 13:15:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10104846.fls.doubleclick.net/activityi;dc_pre=CLPg4KHN0YgDFfdZDwIdrmoEgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4123233115907.0103?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
58 KB 15ms
5ms Script
application/x-javascript 157.240.31.5
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.31.5 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-nrt1.fbcdn.net

Software

Resource Hash

0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=23, mss=1232, tbw=4458, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: 46uF2V9Vtm+eFlgDgCilwc1Mu5iVt3uYHChHiyMmh/TJEX826BLcYd0qkxrCHjQQCbPXcGijuIvNph9wezcK/A==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 58953
x-xss-protection: 0

GET
H3 200 siteanalyze_6033413.js Show response
siteimproveanalytics.com/js/ 38 KB
12 KB 46ms
28ms Script
application/javascript 172.67.163.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6033413.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.163.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "8451e15415563cef4e816d6dd250d58a"
age: 4995
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Izct9CrYjBMHb2mz8oRBziSnyEyHr%2FQi6avFzQdgDHG%2BpaKHq%2Bq2N2oRG%2BGSod1eiJmSHX3BQZBqn2X1irj76IOOQ%2FUKP4B9YZwlzEiPF8YyPwCXfs4o8dLJ26aRuwYv6i1w1pnFI%2FIKKf4%3D"}],"group":"cf-nel","max_age":604800}
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 03 Sep 2024 18:55:37 GMT
vary: Accept-Encoding
x-amz-id-2: 1dv3UAMmnCllds92SIMpKdGwNhYVbfs4QHsHCVQIHNTYvjl2bFmOfuRwahyC1nuLwUtuF1nWG4/BkujKGX+D3w==
cache-control: max-age=86400, no-transform
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: C1EBRCJE10RP3GJC
cf-ray: 8c6215362a258a74-NRT
accept-ranges: bytes
content-length: 11550
server: cloudflare

GET
H2 200 adsct
t.co/i/ 43 B
166 B 120ms
118ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=d6c3a41c-17a5-40e9-a475-50c09dc46071&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=db8be479-6697-401b-a3f4-ef2e38fe9333&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: e6527a2563eb7254
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 3c071d3cdfe5d48e1908d42b0bc7c4ba9454246af5cd665d529a49d8544fc74c
cf-cache-status: DYNAMIC
cf-ray: 8c6215360f6b5c8b-NRT
x-response-time: 99
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
94 B 105ms
104ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=d6c3a41c-17a5-40e9-a475-50c09dc46071&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=db8be479-6697-401b-a3f4-ef2e38fe9333&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 1f99091b9b3e8396
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 7aed5c3edac584fdf622d8a01b9d6f78a6514538d54eceec19b19476bd554ce2
x-response-time: 101
content-length: 43
date: Fri, 20 Sep 2024 13:15:10 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H/1.1 200
OK tracking Show response
tracking.contanuity.com/ 2 B
769 B 355ms
113ms Script
application/json 54.203.236.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.contanuity.com/tracking?visitorId=d13d32f58501fd8aea71a13fdffce4b8_1726838111391&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.203.236.163 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-203-236-163.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 20 Sep 2024 13:15:12 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 163ms
161ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A10%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%222073%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:11 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 182 KB
66 KB 95ms
95ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4NSPPXN

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

76ec385cfb426fdef7dcfb25cf6819385aa1f5bc5bc8ca74ef39d2f0a842fb09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 67108
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 177020962864941 Show response
connect.facebook.net/signals/config/ 66 KB
13 KB 8ms
7ms Script
application/x-javascript 157.240.31.5
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.167&r=stable&domain=www.fortinet.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.31.5 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-nrt1.fbcdn.net

Software

Resource Hash

6c96e2d7e3d052c2c4fc96b42a991077b82cc1118c272a97b8c2880a1ebd9357

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=74, mss=1232, tbw=67098, tp=62, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: otLb2u21ERHfiRWAJFMsSKRdLe5Oy+3l0ZSRU4IMTexSO+fw9kqCbg0vUvSIwDHuQwlNZ1nXo4o77JYk9UGLew==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 13328
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 11ms
3ms Image
text/plain 2a03:2880:f10f:187:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&rl=&if=false&ts=1726838111752&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726838111750.519280937458654241&ler=empty&cdl=API_unavailable&it=1726838111718&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f10f:187:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=10, mss=1368, tbw=2771, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 183ms
181ms Image
image/png 2a03:2880:f10f:187:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&rl=&if=false&ts=1726838111752&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726838111750.519280937458654241&ler=empty&cdl=API_unavailable&it=1726838111718&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f10f:187:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7416713212317050564"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x1df81ccff3911cb6","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"2":["24:1473595392721544","7830:1473595392721544","10853:1473595392721544","41:1473595392721544","8046:1473595392721544"]},"debug_reporting":true,"debug_key":"4306558633184558019"}
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: QOZbyaSjRpHYQhwDHLYVs12tGfVkugsqQ+ySa8XvQqYKFVrQh33zazleXPZg2ITm/1X8iyxnrUj9p5nqgt1gEA==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7416713212317050564", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=10, mss=1368, tbw=3123, tp=-1, tpl=-1, uplat=175, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 tag.aspx Show response
ml314.com/ 38 KB
39 KB 58ms
3ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?208
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
etag: "632616ff15825f030aab3391a58ef042"
age: 1912
x-goog-stored-content-encoding: identity
x-cache-hit: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39162
date: Fri, 20 Sep 2024 12:43:19 GMT
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
content-type: application/javascript
x-guploader-uploadid: AD-8ljv5ZS6UQd2fyqnYERQw8IcIGlW17Dhrh1I0NMsyqxWVrcX1rt99R18UksqqoQ-MzLC-dA
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
cache-id: NRT-cf0517a3
accept-ranges: bytes
x-goog-generation: 1721849450340665
content-length: 39162
server: UploadServer

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 17ms
5ms Script
application/javascript 2600:140b:1a00:4::17c1:b893
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:140b:1a00:4::17c1:b893 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=61979
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Fri, 20 Sep 2024 13:15:11 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 image.aspx
6033413.global.siteimproveanalytics.io/ 34 B
149 B 333ms
108ms Image
image/gif 54.183.57.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6033413.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&res=1600x1200&accountid=6033413&rt=10932&prev=e775cd8a-ebf2-2962-588c-e5a262f224d0&luid=141acc2d-76f3-cb57-9d8c-810d2c796c66&rnd=90856
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.183.57.53 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-183-57-53.us-west-1.compute.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: Fri, 20 Sep 2024 13:15:12 UTC
cache-control: max-age=0
content-length: 34
date: Fri, 20 Sep 2024 13:15:12 GMT
content-type: image/gif

GET
H2 200 utsync.ashx Show response
ml314.com/ 575 B
1 KB 40ms
38ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pv=1726838111832_8j6z05i03&bl=ja-jp&cb=1800790&return=&ht=&d=&dc=&si=1726838111832_8j6z05i03&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?208
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e28c4e004b492caf07e9380cceb7e84131cff7c254686bb2f15caf478d727e14

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/javascript
server: Google Frontend

GET
H/1.1 200
OK is Show response
100.20.58.101/ 32 B
437 B 539ms
137ms Fetch
text/plain 100.20.58.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://100.20.58.101/is
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=33628795205177676term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 100.20.58.101 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-100-20-58-101.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: f601ed84c6b0e90fbf5b8360acad1ce00f7eb89f162374d922d3750e0e24144b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 1
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
content-length: 32
date: Fri, 20 Sep 2024 13:15:12 GMT
content-type: text/plain;charset=utf-8
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
976 B 628ms
619ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=7120%2C2159050%2C4628290&time=1726838111852&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.fortinet.com/

Response headers

x-li-pop: afd-prod-lva1-x
content-encoding: gzip
x-fs-uuid: 0006228cd43f4ca7d7c72becef4d1c32
x-msedge-ref: Ref A: 7736280A820D4C3598A82606B3DC0832 Ref B: TYBEDGE0821 Ref C: 2024-09-20T13:15:11Z
x-li-fabric: prod-lva1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYijNQ/TKfXxyvs700cMg==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"4","priority":"0"}],"filters":[{"c":["182481196"]},{"c":["141366624"]},{"c":["136362026"]},{"c":["134312916"]},{"c":["134309046"]}],"debug_key":"421988"}
date: Fri, 20 Sep 2024 13:15:12 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838111852&li_adsId=67a4cdbe-3db5-471e-80ef-14abbb43c629&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-resea...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%26time%3D1726838111852%26li_adsId%3D67a4cdbe-3db5-47...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838111852&li_adsId=67a4cdbe-3db5-471e-80ef-14abbb43c629&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-resea...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838111852&li_adsId=67a4cdbe-3db5-471e-80ef-14abbb43c629&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-rese...

0
490 B

800ms
178ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838111852&li_adsId=67a4cdbe-3db5-471e-80ef-14abbb43c629&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&liSync=true&e_ipv6=AQJPERtXHo1MJwAAAZIPkoBgYVwpuGdp201PECTAw837k5Radyr0LkmJUYKsghBTv7HKOw
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: E8C353A3E7BC48A1BB6A831CDD397E92 Ref B: TYO01EDGE3305 Ref C: 2024-09-20T13:15:13Z
x-li-fabric: prod-lva1
x-li-uuid: AAYijNRRojjpnRqnc5AVXQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 20 Sep 2024 13:15:13 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838111852&li_adsId=67a4cdbe-3db5-471e-80ef-14abbb43c629&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&liSync=true&e_ipv6=AQJPERtXHo1MJwAAAZIPkoBgYVwpuGdp201PECTAw837k5Radyr0LkmJUYKsghBTv7HKOw
x-msedge-ref: Ref A: 64FB3C72B1914273A44D448D884CEC52 Ref B: TYBEDGE0616 Ref C: 2024-09-20T13:15:12Z
x-li-fabric: prod-lva1
x-li-uuid: AAYijNRFVmp2Hix57ejKrw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 20 Sep 2024 13:15:12 GMT

GET
H2 200 ibs:dpid=22052&dpuuid=3647144416274022480&redir=
dpm.demdex.net/ 42 B
717 B 8ms
5ms Image
image/gif 13.112.211.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3647144416274022480&redir=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.112.211.211 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-112-211-211.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-2-v062-010e6b6df.edge-tyo3.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: HfTif4qvTvA=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif

GET
H3

200

utsync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=bac5e4e8-f265-4612-81ef-59735c488a2c&gdpr=0&gdpr_consent=

43 B
61 B

37ms
37ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=bac5e4e8-f265-4612-81ef-59735c488a2c&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0,Sat, 21 Sep 2024 13:15:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

location: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=bac5e4e8-f265-4612-81ef-59735c488a2c&gdpr=0&gdpr_consent=
content-length: 241
date: Fri, 20 Sep 2024 13:15:11 GMT
server: Kestrel

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3647144416274022480
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3647144416274022480
https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144416274022480

43 B
56 B

31ms
31ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144416274022480
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Sat, 21 Sep 2024 13:15:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:12 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-cache
location: https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144416274022480
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 20 Sep 2024 13:15:11 GMT
x-server: 10.42.6.172
server: Jetty(9.4.38.v20210224)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=28rlz1nDf6nyKXsXHwWRGYRupAaetKFBIFZo_Aff81zA&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

70 B
440 B

7ms
7ms

Image
image/gif

18.182.162.20
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Protocol: HTTP/1.1
Server: 18.182.162.20 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-182-162-20.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 20 Sep 2024 13:15:11 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
pragma: no-cache
via: 1.1 google
expires: 0,Sat, 21 Sep 2024 13:15:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
x-cloud-trace-context: 9e0b98cfe828d4cf8cb35912ae55852e
server: Google Frontend

GET

usersync
tracking.contanuity.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838111391
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838111391&_bee_ppp=1
https://tracking.contanuity.com/usersync?bwcookie=AACBx07N2usAABPjJrtzPA

0
0

GET
H/1.1 200
OK st Show response
px.mountain.com/ 2 KB
1 KB 855ms
127ms Script
application/javascript 52.37.218.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1827021750.1726838110&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221827021750.1726838110%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838110.1%22%2C%22mntnis%22%3A%22xgEdaE7JY5jXkCpbQwTW2E5812OznMCL%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A6%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838110.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838110%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838111%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=33628795205177676term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=33628795205177676term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.37.218.4 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-37-218-4.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: a6d2f4b11eb2acecef705c7b753d70c1895ab2281145134d940593d04cb35358

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 1
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:13 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H2 401 / Show response
webtracker.argusplatform.com/wh/track/ 205 B
469 B 1945ms
1878ms XHR
application/json 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838111001783255&event_type=page_request&timestamp=1726838113&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20240920T131513Z-r1677749c86v7wjlqgfb9dw2ns000000010g00000001y7zw

POST
H2 201 v11 Show response
tracking.crazyegg.com/ 0
82 B 112ms
109ms XHR
text/plain 43.202.117.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.202.117.154 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-202-117-154.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/gzip
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:13 GMT
content-type: text/plain
server: awselb/2.0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 164ms
163ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A11%20GMT%22%2C%22timeSpent%22%3A%221430%22%2C%22totalTimeSpent%22%3A%223503%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:13 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:13 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
195 B 186ms
184ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 04A0E73622C74263A58CF539763EC17F Ref B: TYBEDGE0616 Ref C: 2024-09-20T13:15:13Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYijNRUkccQbczma1cVQg==
x-li-proto: http/2
access-control-allow-origin: https://www.fortinet.com
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:13 GMT
vary: Origin

GET
H/1.1 200
OK gs Show response
gs.mountain.com/ 144 B
733 B 535ms
141ms Script
application/javascript 52.12.117.226
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gs.mountain.com/gs
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1827021750.1726838110&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221827021750.1726838110%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838110.1%22%2C%22mntnis%22%3A%22xgEdaE7JY5jXkCpbQwTW2E5812OznMCL%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A6%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838110.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838110%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838111%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=33628795205177676term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.12.117.226 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-12-117-226.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: fd6bb884006a496f8a72abfb109bfcedd207c18fea7596aaefb874792fc10525

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 0
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:13 GMT
content-length: 144
content-type: application/javascript;charset=utf-8
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H/1.1 200
OK st Show response
px.mountain.com/ 5 KB
2 KB 420ms
178ms Script
application/javascript 52.37.218.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1827021750.1726838110&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221827021750.1726838110%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838110.1%22%2C%22mntnis%22%3A%22xgEdaE7JY5jXkCpbQwTW2E5812OznMCL%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A6%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838110.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838110%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838111%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue&cb=1726838113247801&shguid=a2bf8823-a350-3f04-8327-6ff348bacf2f&shgts=1726838113768
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1827021750.1726838110&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221827021750.1726838110%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838110.1%22%2C%22mntnis%22%3A%22xgEdaE7JY5jXkCpbQwTW2E5812OznMCL%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A6%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838110.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838110%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838111%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=33628795205177676term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.37.218.4 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-37-218-4.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 201c8e4f9577e10cdee02b901b89f1c97f66fda1c746447e955e7f5a421db43e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 52
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 172ms
171ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A12%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224505%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:14 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:14 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1

200
OK

tdsync
px.steelhousemedia.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=5ec077ab-7752-11ef-8656-0f0bcdde48dd&gdpr=&gdpr_consent=
https://px.steelhousemedia.com/tdsync?tdid=bac5e4e8-f265-4612-81ef-59735c488a2c&shguid=5ec077ab-7752-11ef-8656-0f0bcdde48dd

0
319 B

711ms
162ms

Image
text/plain

52.10.121.135
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.steelhousemedia.com/tdsync?tdid=bac5e4e8-f265-4612-81ef-59735c488a2c&shguid=5ec077ab-7752-11ef-8656-0f0bcdde48dd
Protocol: HTTP/1.1
Server: 52.10.121.135 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-10-121-135.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 42
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:14 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

Redirect headers

location: https://px.steelhousemedia.com/tdsync?tdid=bac5e4e8-f265-4612-81ef-59735c488a2c&shguid=5ec077ab-7752-11ef-8656-0f0bcdde48dd
content-length: 277
date: Fri, 20 Sep 2024 13:15:14 GMT
server: Kestrel

GET
H2

404

usync
su.addthis.com/red/
Redirect Chain

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3
https://dpm.demdex.net/ibs:dpid=903&dpuuid=bac5e4e8-f265-4612-81ef-59735c488a2c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://tags.bluekai.com/site/5386?id=bac5e4e8-f265-4612-81ef-59735c488a2c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=bac5e4e8-f265-4612-81ef-59735c488a2c&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YmFjNWU0ZTgtZjI2NS00NjEyLTgxZWYtNTk3MzVjNDg4YTJj&gdpr=0&gdpr_consent=&ttd_tdid=bac5e4e8-f265-4612-81ef-59735...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=bac5e4e8-f265-4612-81ef-59735c488a2c&google_gid=CAESEAY2Qn-Zn-w5UbzkOknzS6U&google_cver=1
https://su.addthis.com/red/usync?pid=11124&puid=bac5e4e8-f265-4612-81ef-59735c488a2c&url=https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fgeneric%3fttd_pid%3daddthis

0
63 B

578ms
326ms

Image
text/plain

23.34.169.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://su.addthis.com/red/usync?pid=11124&puid=bac5e4e8-f265-4612-81ef-59735c488a2c&url=https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fgeneric%3fttd_pid%3daddthis
Protocol: H2
Server: 23.34.169.153 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-34-169-153.deploy.static.akamaitechnologies.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

date: Fri, 20 Sep 2024 13:15:15 GMT
server: istio-envoy
content-length: 0

Redirect headers

location: https://su.addthis.com/red/usync?pid=11124&puid=bac5e4e8-f265-4612-81ef-59735c488a2c&url=https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fgeneric%3fttd_pid%3daddthis
content-length: 357
date: Fri, 20 Sep 2024 13:15:14 GMT
server: Kestrel

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 185ms
184ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A14%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%225509%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:15 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:15 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 192ms
192ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A15%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%226509%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:16 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:16 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 171ms
171ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A16%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227510%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:17 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:17 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 168ms
167ms Image
image/gif 23.50.118.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0eeb749f-0600-4ea7-8b5c-16e76171d4c0&session=3e9e3772-50db-4b21-8297-1d5aaacefb91&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A17%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%228510%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=76538b15-e235-4688-8ebc-415ad7ca02c6&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.169 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-169.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:18 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:18 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.fortinet.com
URL: blob:https://www.fortinet.com/9722a1c6-815f-4f06-bff2-64def4414d6d

Domain: ad.doubleclick.net
URL: https://ad.doubleclick.net/activity;register_conversion=1;src=10050195;npa=0;auiddc=1128146875.1726838110;ps=1;pcor=1425848075;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Domain: tracking.contanuity.com
URL: https://tracking.contanuity.com/usersync?bwcookie=AACBx07N2usAABPjJrtzPA

Verdicts & Comments Add Verdict or Comment

162 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

111 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-21 08:26:14	Name: cookiesession1 Value: 678A3E2311CA53D273AA6831C4053BDB
.fortinet.com/	1970-01-21 08:26:14	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Fri+Sep+20+2024+22%3A15%3A08+GMT%2B0900+(%E6%97%A5%E6%9C%AC%E6%A8%99%E6%BA%96%E6%99%82)&version=6.10.0&hosts=&consentId=f314acb7-badf-463f-bce4-017cac332cbd&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.fortinet.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-21 03:59:50	Name: demdex Value: 81988976200684861792468726032211474849
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
.fortinet.com/	1970-01-21 09:16:38	Name: mbox Value: session#7fd725f7bc9f418389557648308f29ac#1726839969\|PC#7fd725f7bc9f418389557648308f29ac.32_0#1790082909
.fortinet.com/	1970-01-20 23:40:39	Name: mboxEdgeCluster Value: 32
.dpm.demdex.net/	1970-01-21 03:59:50	Name: dpm Value: 81988976200684861792468726032211474849
.fortinet.com/	1970-01-21 09:16:38	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 179643557%7CMCIDTS%7C19987%7CMCMID%7C81645950242206795952505284693039732777%7CMCAAMLH-1727442908%7C11%7CMCAAMB-1727442908%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1726845308s%7CNONE%7CMCSYNCSOP%7C411-19994%7CvVersion%7C5.5.0
www.fortinet.com/	1970-01-21 09:16:38	Name: _gd_visitor Value: 0eeb749f-0600-4ea7-8b5c-16e76171d4c0
www.fortinet.com/	1970-01-20 23:40:52	Name: _gd_session Value: 3e9e3772-50db-4b21-8297-1d5aaacefb91
.fortinet.com/	1970-01-20 23:42:04	Name: _uetsid Value: 5ca57160775211ef8e443b141d914c74
.fortinet.com/	1970-01-21 09:02:14	Name: _uetvid Value: 5ca70630775211efbfdac720e7a8a5e9
.bing.com/	1970-01-21 09:02:14	Name: MUID Value: 14F1822015486BAF17B39720146A6A33
.bat.bing.com/	1970-01-20 23:50:42	Name: MR Value: 0
.simpli.fi/	1970-01-21 08:27:40	Name: suid Value: 48DDDBD30D29424C9F8B3A3C69A6314A
.fortinet.com/	1969-12-31 23:59:59	Name: _ce.irv Value: new
.fortinet.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.fortinet.com/	1970-01-20 23:42:04	Name: _ce.clock_event Value: 1
www.fortinet.com/	1970-01-20 23:40:38	Name: dicbo_id Value: %7B%22dicbo_fetch%22%3A1726838109955%7D
.fortinet.com/	1970-01-20 23:40:39	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
.fortinet.com/	1970-01-21 01:50:14	Name: s_getNewRepeat Value: 1726838109980-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.fortinet.com/	1970-01-20 23:42:04	Name: _ce.clock_data Value: 32%2C146.70.201.218%2C1%2Ccd70ceeb4a1768030b1882c90242a428%2CChrome%2CJP
.fortinet.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.fortinet.com/	1970-01-21 08:26:14	Name: _ce.s Value: v~ef47407801207ad301cf37bdc27a935e41dd21a8~lcw~1726838110145~lva~1726838109919~vpv~0~v11.cs~424000~v11.s~5ce6fc00-7752-11ef-afac-fb39493d1d5b~lcw~1726838110149
.fortinet.com/	1970-01-21 01:50:14	Name: _gcl_au Value: 1.1.1128146875.1726838110
.fortinet.com/	1970-01-21 09:16:38	Name: _ga_38BQ9XFDT4 Value: GS1.1.1726838110.1.0.1726838110.0.0.0
.fortinet.com/	1970-01-21 09:16:38	Name: _ga Value: GA1.1.1827021750.1726838110
www.fortinet.com/	1970-01-21 09:16:38	Name: _omappvp Value: UHWA0rQHua1HS3EJRnQniTbf5iBICDcMX0aj48uWr6Nwau1hqv6DcTkbOBndIKLK4zq9i2MNdGNUjUetIiRFGKXXw7ZeCibD
www.fortinet.com/	1970-01-20 23:40:39	Name: _omappvs Value: 1726838110436
.techtarget.com/	1970-01-20 23:40:39	Name: __cf_bm Value: B6a59epglhIyNv9byEyQ.KeXew5bttOjZtDYid.FxJ8-1726838110-1.0.1.1-S1.myr6m4ZVS2vX5pq1UTLWqWCZU_OAWbOOje.GaFRgNgTJ_wSnGLPWff12be5cNEFlG1trk3x.3xOAAyKFjjg
.doubleclick.net/	1970-01-21 03:59:50	Name: receive-cookie-deprecation Value: 1
.doubleclick.net/	1970-01-21 09:16:38	Name: IDE Value: AHWqTUlVtkmvak65lRqeR7uhgy80vNX1yXFtfsP748nVv4QmKWxlf-x0sZ880NGg
.fortinet.com/	1970-01-21 09:16:38	Name: _ga_JH142QCQCJ Value: GS1.1.1726838111.1.0.1726838111.0.0.0
.www.fortinet.com/	1970-01-21 08:26:14	Name: WID_VISITOR_ID Value: 1726838111001783255
.simpli.fi/	1970-01-20 23:50:42	Name: uid_syncd_secure Value: true
www.fortinet.com/	1970-01-20 23:50:42	Name: AWSALB Value: GWIB5wQ5Ok5HYRqAVmR8v79n/s6x+cb90F4qTbScrXgjoIWtjcju/IebtMf1gG7azjzv4YhdbjOfjg2YurP0kPnFh6u5rLlT+duuj1d50U3FaGNNHbB3zyTITFm9STaN3b7N2HI92n8NF0j1U+6rmg2c3NzUiZ1XwJ++hqob3nI6ZAPFEqyaUNO5JtTmC4tLAZ/8OJu2dS+d6iwADHca5awtiy6qi9KA
www.fortinet.com/	1970-01-20 23:50:42	Name: AWSALBCORS Value: 0hMrL3rDl6sSBxTU2u/KjqIUac4WO0JN/M345q8kPOkKAT8dPB2I5gNBBlyZT0Wu39JPA2D4VTQPu8DmvPR56aErrMI3z/g4Zg27vgkWe/1O4t5ICJalIYbz1+rn8VAvE5N427MfEOKyiCPj5JitIA5BuGF4D2aIqiv8TUYg9yj1xE5cGA5Mg1ZzGj+2wwuAf85Vcwd0SEICMVRKIUSWBnOldQyxcNz1
abm-tracking.demandscience.com/	1970-01-21 09:16:38	Name: userId Value: d13d32f58501fd8aea71a13fdffce4b8_1726838111391
.twitter.com/	1970-01-21 09:16:38	Name: personalization_id Value: "v1_CImyYz6GRCNK0FtTBbYrkA=="
.t.co/	1970-01-21 09:16:38	Name: muc_ads Value: 99443fd7-ded9-4ebf-9c20-38e7dc2f5ae0
.t.co/	1970-01-20 23:40:39	Name: __cf_bm Value: sdXEeQ_hiTdffg6eDkkLsWKjwkXI1qEPFoPsTCSlyyU-1726838111-1.0.1.1-BNL70O8uHO_pJUpshQXHyIi2Hvl3hVjYli.JdPrYsY.qndfGyrtBBrum6VSl_xlJuZK3KgM7IJoZTlLdI4Rt_A
.adnxs.com/	1970-01-21 09:16:38	Name: receive-cookie-deprecation Value: 1
.doubleclick.net/	1970-01-21 00:23:50	Name: ar_debug Value: 1
.smaato.net/	1970-01-21 00:10:52	Name: SCM Value: 0fa13d61a2
.smaato.net/	1970-01-21 00:10:52	Name: SCMtapad Value: 0fa13d61a2
.smaato.net/	1970-01-21 00:10:52	Name: SCM1001136 Value: 0fa13d61a2
.agkn.com/	1970-01-21 08:26:14	Name: ab Value: 0001%3AWGsuQF9rU987sWNw7KooLFQVVP%2BaHCtP
.adnxs.com/	1970-01-21 01:50:14	Name: XANDR_PANID Value: ll9J6pJpKmT3l7i17nt7-NA8NZpQ6yXYdKEsYGuG1UDnFUC2EQzymFCIjQeJ12JCxGOprI5DBRk6Iy8cIayD_Wq-0l5-tS3GIAVY7j1KP4g.
.adnxs.com/	1970-01-21 01:50:14	Name: uuid2 Value: 8175912557473997712
.agkn.com/	1970-01-21 08:26:14	Name: u Value: C\|0AAAAAAAALoAx3wAAAAAA
.fortinet.com/	1970-01-21 01:50:14	Name: _fbp Value: fb.1.1726838111750.519280937458654241
www.fortinet.com/	1970-01-20 23:42:06	Name: aa_cc Value: RO
www.fortinet.com/	1970-01-20 23:42:06	Name: aa_cn Value: Romania
www.fortinet.com/	1970-01-20 23:42:06	Name: 6scexist Value: true
.1rx.io/	1970-01-21 08:26:14	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-1e42aa08-ea35-4aa3-936f-e89fa4a94768-004%22%7D
.linkedin.com/	1970-01-21 01:50:14	Name: li_sugr Value: 1e156235-3f46-4521-b5b8-5709f69225b0
.linkedin.com/	1970-01-21 08:26:14	Name: bcookie Value: "v=2&82413df6-65a5-4355-876d-59314f3db736"
.linkedin.com/	1970-01-20 23:42:04	Name: lidc Value: "b=VGST04:s=V:r=V:a=V:p=V:g=3349:u=1:x=1:i=1726838111:t=1726924511:v=2:sig=AQHOkDJJPfduBNhpKkwjPGZfB_r5qsRM"
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_TS Value: 1726838111693
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_DID Value: a2de8d86-8e04-4b40-af2d-13933b7e67a5
.adsrvr.org/	1970-01-21 08:26:14	Name: TDID Value: bac5e4e8-f265-4612-81ef-59735c488a2c
.adnxs.com/	1970-01-21 01:50:14	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2GVVqOe]Z!]tbPl1N!7OnM$=BWUeeTtl@eVvzJfS<$Ne:eWedXGL]ka.OxiIP:ne+8Mq]313/X%W#.wL4W1Qw2Le^M^>
.fortinet.com/	1970-01-21 09:16:38	Name: nmstat Value: e775cd8a-ebf2-2962-588c-e5a262f224d0
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_3WAY_SYNCS Value: 1!6349
.3lift.com/	1970-01-21 01:50:14	Name: tluidp Value: 2164144819145389078126
.3lift.com/	1970-01-21 01:50:14	Name: tluid Value: 2164144819145389078126
.intentiq.com/	1970-01-21 09:16:38	Name: IQver Value: 1.9
.intentiq.com/	1970-01-21 09:16:38	Name: intentIQ Value: MiBsknZbMz
.ml314.com/	1970-01-21 08:26:14	Name: pi Value: 3647144416274022480
.ml314.com/	1970-01-21 00:00:47	Name: tp Value: 3%253B09%252F20%252F2024%2B13%253A15%253A11%253B0
.bluekai.com/	1970-01-21 04:01:16	Name: bku Value: blx99a2NfVSYKWyr
.eyeota.net/	1970-01-21 08:26:14	Name: mako_uid Value: 1920f927e97-3740000010e4c57
.eyeota.net/	1970-01-20 23:40:38	Name: SERVERID Value: 19543~DM
.crwdcntrl.net/	1969-12-31 23:59:59	Name: _cc_cc Value: ctst
.ml314.com/	1970-01-20 23:40:38	Name: u Value: aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLw%3D%3D
.targeting.unrulymedia.com/	1970-01-21 08:26:14	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-1e42aa08-ea35-4aa3-936f-e89fa4a94768-004%22%7D
.rubiconproject.com/	1970-01-21 08:26:14	Name: khaos Value: M1AQTQSK-11-C9Z
.rubiconproject.com/	1970-01-21 08:26:14	Name: khaos_p Value: M1AQTQSK-11-C9Z
.rubiconproject.com/	1970-01-21 01:50:14	Name: receive-cookie-deprecation Value: 1
.intentiq.com/	1970-01-21 09:16:38	Name: intentIQCDate Value: 1726838111936
.intentiq.com/	1970-01-21 09:16:38	Name: IQPData Value: 2454112730#1726838111934#0#1726838111934
.intentiq.com/	1970-01-21 09:16:38	Name: ASDT Value: 0
.intentiq.com/	1970-01-21 09:16:38	Name: CSDT Value: UEQ6MTAwNDNfMCZVT3Y2amJ0
.pro-market.net/	1970-01-21 03:59:50	Name: anProfile Value: "b7hfdkxjui79+1+1f=1+1g=1+1j=12+rs=s+rt=20010AC80040001E000000000000002E+s2=(sk44tb)+vm=24-48DDDBD30D29424C9F8B3A3C69A6314A"
.pro-market.net/	1970-01-21 00:23:50	Name: anHistory Value: "b7hfdkxjui79+2+!#6wM$z#T+g"
.rlcdn.com/	1970-01-21 01:07:02	Name: pxrc Value: CN/qtbcGEgUI6AcQABIGCLrqARAA
.linkedin.com/	1970-01-21 00:23:50	Name: UserMatchHistory Value: AQLVXhBdyEwINgAAAZIPkn7TBMDwnFOvzRdelr65WhcnbDAEsbR3bRQ6-K2xduoUIfLxCLOz2AVlBA
.linkedin.com/	1970-01-21 00:23:50	Name: AnalyticsSyncHistory Value: AQL-7t1MhmiWNAAAAZIPkn7TWlK4zFeKspd39vx4OeY6Ky_HNqErVSOxbz7-x9qCndBDN9F2ljMuwZ3Qzu50_A
.lijit.com/	1970-01-21 08:26:14	Name: ljt_reader Value: JXQbAQZHkDysN8_iRMOWPtek
tracking.contanuity.com/	1970-01-21 09:16:38	Name: userId Value: d13d32f58501fd8aea71a13fdffce4b8_1726838111391
tracking.contanuity.com/	1970-01-21 09:16:38	Name: clientId Value: undefined
.bidr.io/	1970-01-21 09:09:11	Name: bito Value: AACBx07N2usAABPjJrtzPA
.bidr.io/	1970-01-21 09:09:11	Name: bitoIsSecure Value: ok
.lijit.com/	1970-01-21 08:26:14	Name: _ljtrtb_2 Value: 48DDDBD30D29424C9F8B3A3C69A6314A
.www.linkedin.com/	1970-01-21 08:26:14	Name: bscookie Value: "v=1&2024092013151281b0354d-b498-431a-88f7-0f9cb4f96360AQH82fcBThYz0VkE_5mWht7GkSnUvEmC"
.smartadserver.com/	1970-01-21 08:26:14	Name: TestIfCookieP Value: ok
.smartadserver.com/	1970-01-21 08:26:14	Name: pbw Value: %24b%3d16999%3b%24o%3d99999
.smartadserver.com/	1970-01-21 08:26:14	Name: pid Value: 7317979095917435683
.bfmio.com/	1970-01-21 08:26:14	Name: __141_cid Value: 48DDDBD30D29424C9F8B3A3C69A6314A
.bfmio.com/	1970-01-21 08:26:14	Name: __io_cid Value: b3cfa783b16a5fce8deafbb72d4ebfc9fc7bfa59
.exelator.com/	1970-01-21 02:33:26	Name: EE Value: "19b7a668697706c3c7c8e90b06f6c4af"
.exelator.com/	1970-01-21 02:33:26	Name: udo Value: "gAAAAAQAAAUlKLUv%252FWAlBIUaAPYtqUgQi6oOAKAIAHBHADo4ACBKBnBgU5ttxD4A6PQ6D4Sk4QuuPj4ofmZlIGzxS1sUVcy2coNspLqfjbBKtqT28AXhIeHuSQZYRwqVAJQAkQDgCDI76Ikc4HeS85ZpIyZYbja8m53wJIU6lTgjJe%252F763ArNa0tySMBccTO3vT96TBs1IhBpOn58BKt5VyhtXZxtlnyccOCLt54uNdBpuh1DoYdNjnwItRXTYnEUnDK%252BqdQfUfjESBUoTz3MOL%252FJX5lZWXlC%252Fw%252FAAWvAgKnrFEj7ii1q0gFChkEZJD4B%252BG%252BsYE2hVkXAh0toWCtkNITN6xNXxRrWkUX9TytbpuOHU7Q0xlCz7UNvUzQ88od2tSVsLaal6Z1RstwGUZreOGW%252FRChWg5W4Me9vkFym7hKUlc9RyMm13Cyl2KJ2rqXlF1bVHrBbJnJJCT56zzFH8kfgMCN0uVgRYIiSe71LZ3viIbzFINIHoLm9jSfEgaKG5x7JJ8In7Dr%252B%252BGmXysoKOyKQraaoALtr3NMs4dgCVNt9HDsHJwWgReR6rHOOes0kt35Mjqz0DmzyBgLbtMcylHsDzbZ4ddYipqOPVwMQXJ0biJuxOVQ7tKMCCPSRFzGYDouw3EnJtTpy6t84ofVZZpFghyujlPpdVcSCAInx71pjdsd52lb02Q2nbdlW5d9Wfs03%252FdltsurdDbllrMyj2HiH%252BVBZFgyLB8sHwLtYFkx1lRiqVhRHBuNQqyY66IsbcJCxf8joPgBL%252FESExb%252BItOaw0BDFzqTXIzRRYNXUVfUBQt5dRYZIwKD0yPBqFFxenAIPZvT96dFek%252BrCRb7ILkkkVj5iRmWFJDza11Xhtk4kYyaqgBRSyf6UrVi7ulMVU89S6KUdUtCPKKmcw%252F2j2EipWOVYUlBVwFCIEACQpBDZh70hbOY5PwVFsgkdZUkLYc6CcFndyjweXLWPMSyBQaojcMxKfr1SCRdE%252BGYAE1s4WxxT7GFzK7dB3VaVBBfA2YPtSW442ODiRHBCaCDXPALJsnSxXtBLvwsfYPUCW9RRvwuiqxz0Jq4sF42D2z1eBUD05QFKjNz38IcCMc4Hwy%252BpOWpVMLf%252BzVuZwLXagWntem7EQRYfWgMMyjL2N7vwyUD"
.exelator.com/	1970-01-21 02:33:26	Name: ud Value: "eJxrXxzq6XKLQcHQMsk80czMwszS3NzALNk42TzZItXSIMnALM0s2SQxbXFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDIckl%252BUWb6Iq%252BAxUUpaQyLSopPBZ9kPwkAkm4qKQ%253D%253D"
.mountain.com/	1970-01-21 08:26:14	Name: guid Value: 5ec077ab-7752-11ef-8656-0f0bcdde48dd
.px.mountain.com/	1970-01-21 08:26:14	Name: tt Value: "H4sIAAAAAAAAAKtW8guKNzYyNjaLNzK3NFayMtBRgnItjC2UrAzNjcyADENDE0MzQx2lMiUrIx0kLWA1BrUAmrh5DEYAAAA="
.mountain.com/	1970-01-21 08:26:14	Name: rt Value: "MzIzMzY6MTcyNjgzODExNA=="
.rubiconproject.com/	1970-01-21 08:26:14	Name: audit_p Value: 1\|9NVFGIo3MGTn3ItE3D14LqidvSVHq3nkwlKTkGduXrsRdwtRav1lhn2f35FaxAWYNvpRKnYxhdGM1KxoLazIt04KBbjzRD/Y5dDZuxGLGk+erMpAmeodAyJvlhVTnlpqKFanb8minchOIHgiCxuv1x48XbwHI8bESpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.rubiconproject.com/	1970-01-21 08:26:14	Name: audit Value: 1\|9NVFGIo3MGTn3ItE3D14LqidvSVHq3nkwlKTkGduXrsRdwtRav1lhn2f35FaxAWYNvpRKnYxhdGM1KxoLazIt04KBbjzRD/Y5dDZuxGLGk+erMpAmeodAyJvlhVTnlpqKFanb8minchOIHgiCxuv1x48XbwHI8bESpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.adsrvr.org/	1970-01-21 08:26:14	Name: TDCPM Value: CAESFAoFdGFwYWQSCwigrYWmieCsPRAFEhYKB2QwdHJvMWoSCwjSsPemieCsPRAFEhIKA2FhbRILCNzBkN7PraE9EAUSFgoHYmx1ZWthaRILCILf_r2J4Kw9EAUSFgoHcnViaWNvbhILCNDu47-J4Kw9EAUSFQoGZ29vZ2xlEgsIlN_-wIngrD0QBRIWCgdhZGR0aGlzEgsIoIb_wIngrD0QBRgFIAQoATILCJCR6eqf4Kw9EAVCFSITCAESDwoLTk8gVHJ1T3B0aWsQAVoHNnMwemFldWABcgdhZGR0aGlz

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838111001783255&event_type=page_request&timestamp=1726838111&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838111001783255&event_type=page_request&timestamp=1726838113&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://su.addthis.com/red/usync?pid=11124&puid=bac5e4e8-f265-4612-81ef-59735c488a2c&url=https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fgeneric%3fttd_pid%3daddthis Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
401.tw
6033413.global.siteimproveanalytics.io
a.omappapi.com
a.opmnstr.com
aa.agkn.com
abm-tracking.demandscience.com
ad.doubleclick.net
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
b.6sc.co
bat.bing.com
bcp.crwdcntrl.net
c.6sc.co
cdn.cookielaw.org
cdn.jsdelivr.net
ce.lijit.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
d.agkn.com
dpm.demdex.net
dx.mountain.com
eb2.3lift.com
eps.6sc.co
epsilon.6sense.com
fei.pro-market.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
i.simpli.fi
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
insight.adsrvr.org
intentstream.contanuity.com
ipv6.6sc.co
j.6sc.co
loadm.exelator.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
pixels.argusplatform.com
ps.eyeota.net
px.ads.linkedin.com
px.mountain.com
px.steelhousemedia.com
px4.ads.linkedin.com
s.ad.smaato.net
script.crazyegg.com
secure.adnxs.com
simplifi.partners.tremorhub.com
siteimproveanalytics.com
snap.licdn.com
stags.bluekai.com
static.ads-twitter.com
su.addthis.com
sync.1rx.io
sync.bfmio.com
sync.crwdcntrl.net
sync.intentiq.com
sync.smartadserver.com
sync.targeting.unrulymedia.com
t.co
tag.simpli.fi
tags.bluekai.com
tags.inzynk.io
td.doubleclick.net
tmp.argusplatform.com
tr.outbrain.com
tracking.contanuity.com
tracking.crazyegg.com
trk.techtarget.com
um.simpli.fi
us-u.openx.net
v.eps.6sc.co
wave.outbrain.com
webtracker.argusplatform.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.co.jp
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
ad.doubleclick.net
tracking.contanuity.com
www.fortinet.com
100.20.58.101
103.43.90.117
103.43.90.19
104.19.147.8
104.244.42.131
13.107.42.14
13.112.211.211
13.225.183.12
13.248.142.121
13.250.176.54
142.250.196.130
142.250.196.98
142.250.76.131
142.251.222.36
142.251.42.136
142.251.42.162
15.197.193.217
151.101.228.157
157.240.31.5
172.105.230.106
172.217.161.34
172.217.26.230
172.66.0.227
172.67.163.237
18.182.162.20
23.106.127.57
23.32.225.140
23.34.169.153
23.36.17.70
23.50.118.169
2400:52e0:1501::1193:1
2404:6800:4004:818::2008
2404:6800:4004:823::200e
2404:6800:4004:825::2002
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
2600:140b:1a00:4::17c1:b893
2600:140b:1c00:39::1732:761f
2600:140b:a00:383::1e80
2600:1901:0:8eee::
2600:1f18:612b:4200:439f:77e3:80bf:81be
2600:9000:26f2:1600:19:fc2c:a140:93a1
2600:9000:2751:3600:12:dfa9:e200:93a1
2600:9000:27af:c000:1b:5138:8a40:93a1
2606:4700:3108::ac42:2af8
2606:4700:4400::6812:2089
2606:4700::6812:1347
2606:4700::6812:562a
2620:1ec:21::14
2620:1ec:33:1::10
2620:1ec:bdf::46
2a03:2880:f10f:187:face:b00c:0:25de
2a04:4e42:600::485
3.164.110.92
34.111.113.62
34.111.208.231
34.117.77.79
34.124.209.251
34.229.3.43
34.87.122.136
35.244.154.8
35.244.159.8
35.71.178.8
35.82.115.140
38.133.127.191
43.202.117.154
44.226.187.177
52.10.121.135
52.12.117.226
52.197.184.52
52.23.38.239
52.32.164.86
52.37.218.4
52.68.127.144
52.74.120.137
54.183.57.53
54.190.217.118
54.203.236.163
63.140.50.233
69.173.158.64
74.118.186.107
74.121.140.211
99.83.231.3
0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096
013f12ee268cd0ef9687049ee36ea1abb72a5c1db557ed6bfb5cc6a9ba30d018
044bdbcf41f0f4586f1d54f3843c97a6e0ad55a9184cfd20d0ca0f3fc7ca6d52
07405b002bac345765f6de032ed07cac28e77745e73850bf4aed8f891822c37a
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0be9fc1923bfa5bd67a699ff0f49420e460c09b27bcb63dd4d682a0fa2ef5b5a
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
10fc9a12b905f9f21665f11fa5b183eae31166f74fce090bf179eb4c823b5ecc
11c69167edad4aa2ac0c3def81f10e2caf7375ca37d9170e9277ac2cef39eb32
128e745d89a0b8501715fcd47ae9d657f2ad6c56cd949d7da1335c82f3dcb214
15c2c29198d9315260cc26261e96a036d215fa28a46836302a576392e0e20ecd
1a962d2b05e2b420f94ab50069ec3028684b7955343965459ab1c81bca368e9d
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
201c8e4f9577e10cdee02b901b89f1c97f66fda1c746447e955e7f5a421db43e
21aaea8d55693ea73c2e3d8afbf8358f3bfa56ae0d8a0abb07221a83373da2d5
229849a4c44505b2599f1a321b139fb5ab32d04a4e0f8d9844b1827e60b80d9f
2589fe281a342d19f8ddcd924727496b916202c4e42edb2553f25074746db938
291ac3898f3f28bd32810a5ef0f380363afee480e535632f0254da751f775c63
2c88a96aaccfda2bf3f3c29d069fea858423e9cebcc1392a1021ec76538498ba
2cc20824e35c6be438211ca8dcf0baa6b8e6df5473454d953a0c96d10eedae7e
2d0ddcf9662d44f133470ee7c926c568e540874718195167d7ce2eae31839a2c
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2eceae481c2cda87ecdc8e65c8bbd62ddc9538144c42ff6c1cd720cd5781623c
2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
320f37b3eca2011055c9ab5a10b5de0f57a22fd740e504fe7e02c9898041abbb
351ba146db40e108b8dcbf0f9cc288d6cc19615020b2aeb1c0f508b79e78b93e
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
38cfaeb6a3cb2cff2b9b11f9945838fd640ac7c0483e093239a29400c7d2ee66
3d6bc3dbcf9e2cf02f556ae8bd0936e8b62540189823df29c4f524c060bb8328
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44fc655655fedce3141e358eabb02c39e838d48e6643b1c58c395adfc23757d2
4713f4e99bebe488012bb9f5ccbaa25d83f2ecec4dbfc2c71f81ad33df9d1c10
4b1017ddd583b8790466a28987a1dabd2d750fcbc0dbffbf263bee2e4cd35791
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e087b4fdf2d01e82e172c013dadf27dd879737dd595df92fa435f4662538d51
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
5072cb8f4c6522e91c53fa0b2c4a36a3aa078b5b78ac9d48f317649a055a1e1d
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
59d12a10e99345ccbe1776752be1dcab5d337248fb1f523fb3cf93ffecf3a779
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5b7b4be8ed582776a1ad52eed0fe06afe968c34e31d566c473feb92ac6a270e0
5b7e10ef15a4fdfd73c69fa16e91aef21861455628f5ac87e72bb5f951e9976c
5ef0e68967411e0314dcc9b45416c54100ebf112f0fc6dc08cc3e1f1f9fa0436
5f83323b31dd79cc7f9104b638a2706b0e12b6e521f48d21ba638b67279f4417
609ca44aa6a92944559e4d17e84e29651b391c6c3438184474fd67e602250e7d
6159fa98f5205e8f16d20648687e1f31878ae2e7c0496bc1788c737e019ae57f
61c4417c2b9d4cba0069ef57a404bd5d9c7a7e4c768f57747b1c084cb9b373ce
6277e3210b9fb4b3b4f0d452b7f91bda534fb23f8ecbe7f9b15dcdf85626cea6
6305f99e66b3ae3c375efe4b1128ab3dcdc2d66c63b97ba6b891096de9b20b9d
66a4281a7684239d0eaeb9e42ad71f249a5a452e286acdb9f99040797ff6fb15
6bb4e76fdeac3f86fe514013ea4ec43b69cf824a9cb00b4d90ca33eb27df3712
6c96e2d7e3d052c2c4fc96b42a991077b82cc1118c272a97b8c2880a1ebd9357
6cea900299a995ce31b2ad62fde2b400c6886f61301debf651e246b251fc1f13
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552
701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f
706300e054788f930de76af585fc6511091289d01c65c440964ca6abb898e7dc
71e3c0057bec6dab5d49a1b6994c8e4fffa97614ba115bc8747a2be7c43ed048
73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4
73ade03dfeae221bb318514f70aa5ae9c9c653b6871008ef9a3596f9255a78f1
76ec385cfb426fdef7dcfb25cf6819385aa1f5bc5bc8ca74ef39d2f0a842fb09
7701282ea59743a1d336ee5ede4e6805ca9572c28ad013fa956fb39f18de0d69
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
7a520fb2812687266f06520e650deb9dece37e49629623c4be612b1f561e11df
7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
7fc88a2ccff93251684fc0526a1ef83f6b65bccc949e449d86f4df1bf945da94
8109fbd42099eef3aed0564d81e4502bade4a64b6bd5174894f0f1e8019cd421
83201017e411b72434080a221b102049e9074e205d97f65219d2286abd683012
83696e40fbfd1571ed67e2350fee62e221fc85b136050b49a6802f6aab8bf704
8489534bde4ad3c3cedebecd11b9babe653de6b413922ec2b877c5bfcb33ee3e
88271145afa467c5e2f2391754e9a01d967855a789f3b75e8b677298a7659ad3
88a5f8b5bcd4b32ed398b199bfc0ecf20ba41bf544d2ca04bc40111db7c66ab3
89905a0e0efe1119d95b1e69de27157b35b8043115708fa06eb74dc706568a7b
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
8a84bc1c645bc2d9b6e41e4e8b4582c2dbd3569b51df5ecedc989410e6be8fe7
8aa55e23264576a3203c911220c574fe36367136dbdc755c10dc6224767c4eb5
8b195a98b1a9fa227dd6712c4af7ccbd807baa4a4b21491d97dbc09c1e13798a
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
8d121b33124fce841c6927c1214d2aa4fe7e5c52629de45f68f325f749a5857d
8db92e7cdc1ad40168c42e93b05d842e056d8a5b83ae96b95d2b1c546f828196
8dbdd526d3da8b4924bc169cb3faee88cda6da11742ef935ae2e916a17b7d978
8ff6ee1950e6f70a130f69e94e575f9d5f7c5de60be4be09311deedeb91e6d61
904ada5a93d55f8c5412c4472a62bfbc46e215422ebdea166d95ed3434d97d4f
91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f
930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6
94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66
956915db9ed8f96ac4ee123a7909637e7db25f3ea20e41927c5fcc4fd50108ee
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d
9a57c6cd6129a6ae679af72011e4529d2c322ff41ca4933dedd76150ffcae369
9ae293c59bba08f1a56f697a11015ee4b251b0f38c309f83c80d7f6e7369caa4
9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36
9cbf9589d98422a08f788b3863a74d1a27c3d92289f8829620c4d8925b967b94
9f313c8c3aaec2c1b82bdf04b99d12b5b456dd6e4ccb2957e7a584c42683eba5
a036dd51b9d09070b4cb8eaa91c1a5abac51f7027e9741c79343a35411be739c
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a4b0a228372854369707f452fb9124e5bc34319c8c3323b5379111ac9ba4bac6
a64c1f9973cb3883a133e383d544adad0468de8e85a2bdb61187dbecca9864b7
a6d2f4b11eb2acecef705c7b753d70c1895ab2281145134d940593d04cb35358
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab5b000d7c8c84f2cc6dbaacd88498126fa4b2fcb04cf14ae9fcd8eef9623760
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae7d18a41edd5f27e717f872a1113addddbf1553e00b3db1baefa99b68fda302
af89d0f65e1c53f2831c1b73f25ee3053fddc6551962dc58eada982a2fd99bdd
b124eed22afdf03abf94714c7632d5f462c0fca7725d014a4469f3b4a0f1083d
b133508601dd82610cda75ed20bc034dd90b459dcd74b8b44e75998e38d19477
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
b66a76be051ae670f5c2786172af1a704f1ecdb15aea3c3402fb42b9e5470598
b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb50d0022dac04a6c6a2fc5edf927a4682c8e6b73a970546c75ff118f06ad4e0
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869
c2cd52aef52bd7a14d5e8b101e3e6c969f35eb4f1ddab97290edddf4c8416f84
c3a522b15c8dd585c2cb4e503fdce8145d08a8eccb0e2cd7138864bba293c843
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86
c6c7eafdd4ce7cbca90175e42e4d11a9ebcfaed70b6471572a0d3d0ae7dde57f
c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cee682bc57d94c16933b0422aa0bd7ad8c7a6e04643eb7ce170e2d5ce6e25b48
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfbffc5a6b6598cb0bf93565da00397f881e0198bf2f24c8d963e4c7cfb45abf
d04f03c209c8b79223d1147dec2771c3e87a401dc1348b7dd10de0aa7d22297f
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2ac7d5402f2266e77a525cf70164ad40fb86b0981530cad5af3e3610a209768
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d98bf7483812de53be541b21b22b1cc519065b76ed31780f33bf8254e688812f
da9671920127171a9289888088dc3d9f3b62f2af8c3ac142f456faa1d49eccda
daaa79b81fa49a10852df79446783b9c51de167ee31aaff722e030c6cacc674b
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
df9f1f8f4deeec8193dbcf3074a9e4767db05cc6c3b4dca6a9cafff884fb0816
e28c4e004b492caf07e9380cceb7e84131cff7c254686bb2f15caf478d727e14
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e708a54b75ed6fd1fe7886153e485c91697f1ab440feed4efd10262575b7e7cb
e72fc9693b94bd6f4cea4fa172adc70989eca7c72cbdcb48f51ceaa7063ab230
e8f00eb416ad5af6f4524e1b7efd086a2244bf48757eee0fbdf583c20afa1dad
ec58ceb768e02c31b87f084fbe10f719b0c42d29c98fcca298688768c6f899e2
ed25439a95a5e80366491d61110058073f12ee6e7d8819eab0bd2f84b73ff369
ee555b56d11e10b0a60e50d84be13221d318b328d16a7b59d77bb5dc7007e4d2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f188b1683849ebab2c42aa623674d573d89c3a8b8a533f4e2ec35fe7a9e8000e
f1d0599a803eb0bc984213e78d9f0ad1cefb2969b1fff4862df9ee0927d20df1
f2771985061ab617dd696611136d31d58dba565372eaf86c562d59d8bae3fd9d
f5e502c3f7f0d4f9c48ce3b790e297dd427601ee7676632ed89be138be48a6a8
f601ed84c6b0e90fbf5b8360acad1ce00f7eb89f162374d922d3750e0e24144b
f8f726a217af8471c5c0e2c11fca16865b7dc42485185311fcbfa0603a4f7120
f90b5ef7baa9dfccda582eb0ec80a2e2848cd5b3edc866629cda33cf4ff6df48
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fd688f7a638dad7a8d7c394f5443ed8ccb3158d4555937c1e0f51546b2fc9612
fd6bb884006a496f8a72abfb109bfcedd207c18fea7596aaefb874792fc10525
fd9f918bd5a22813d48748b8c79e2acaeeb590d217575e0d79d734cba9de7736
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.fortinet.com Open in urlscan Pro 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

237 Requests

86 %HTTPS

27 %IPv6

63 Domains

93 Subdomains

74 IPs

6 Countries

6852 kBTransfer

10723 kBSize

111 Cookies

21 Outgoing links

Page URL History

Redirected requests

237 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.fortinet.com Open in urlscan Pro
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Screenshot
Live screenshot

Full Image

237
Requests

86 %
HTTPS

27 %
IPv6

63
Domains

93
Subdomains

74
IPs

6
Countries

6852 kB
Transfer

10723 kB
Size

111
Cookies

237 HTTP transactions
2 data transactions