www.fortinet.com Open in urlscan Pro
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://401.tw/Mr6E
Effective URL:
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Submission: On September 20 via api (September 20th 2024, 1:15:41 pm UTC) from IN — Scanned from JP

Summary HTTP 233 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 72 IPs in 7 countries across 63 domains to perform 233 HTTP transactions. The main IP is 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06, located in Singapore, Singapore and belongs to AMAZON-02, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 115924.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 16th 2024. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.105.230.106 172.105.230.106	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
60	2406:da18:ad1... 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	2600:140b:a00... 2600:140b:a00:396::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	18.179.63.210 18.179.63.210	16509 (AMAZON-02) (AMAZON-02)
1	54.92.33.217 54.92.33.217	16509 (AMAZON-02) (AMAZON-02)
1 1	18.139.230.53 18.139.230.53	16509 (AMAZON-02) (AMAZON-02)
2	63.140.50.191 63.140.50.191	16509 (AMAZON-02) (AMAZON-02)
6	104.19.148.8 104.19.148.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	23.50.118.161 23.50.118.161	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.207.173.158 23.207.173.158	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.87.122.136 34.87.122.136	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
7	2404:6800:400... 2404:6800:4004:818::2008	15169 (GOOGLE) (GOOGLE)
2	38.133.127.191 38.133.127.191	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	2600:140b:1c0... 2600:140b:1c00:39::1732:7614	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	76.223.9.105 76.223.9.105	16509 (AMAZON-02) (AMAZON-02)
4	43.202.117.154 43.202.117.154	16509 (AMAZON-02) (AMAZON-02)
2	2400:52e0:150... 2400:52e0:1501::1193:1	200325 (BUNNYCDN) (BUNNYCDN)
2	2404:6800:400... 2404:6800:4004:823::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700:310... 2606:4700:3108::ac42:2af8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.32.164.86 52.32.164.86	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:bdf::46 2620:1ec:bdf::46	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	74.121.140.211 74.121.140.211	30419 (PAEDAE-INC) (PAEDAE-INC)
2	142.251.42.136 142.251.42.136	15169 (GOOGLE) (GOOGLE)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2404:6800:400... 2404:6800:4004:825::2002	15169 (GOOGLE) (GOOGLE)
1 3	172.217.26.230 172.217.26.230	15169 (GOOGLE) (GOOGLE)
1 4	142.251.42.162 142.251.42.162	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
2	44.226.187.177 44.226.187.177	16509 (AMAZON-02) (AMAZON-02)
1	172.217.161.34 172.217.161.34	15169 (GOOGLE) (GOOGLE)
1 4	142.250.196.132 142.250.196.132	15169 (GOOGLE) (GOOGLE)
4	142.250.76.131 142.250.76.131	15169 (GOOGLE) (GOOGLE)
1	52.88.179.26 52.88.179.26	16509 (AMAZON-02) (AMAZON-02)
1	151.101.228.157 151.101.228.157	54113 (FASTLY) (FASTLY)
1 2	103.43.90.19 103.43.90.19	29990 (ASN-APPNEX) (ASN-APPNEX)
1 3	103.43.89.4 103.43.89.4	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:275... 2600:9000:2751:3600:12:dfa9:e200:93a1	16509 (AMAZON-02) (AMAZON-02)
3	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
2	157.240.31.5 157.240.31.5	32934 (FACEBOOK) (FACEBOOK)
1	172.67.163.237 172.67.163.237	13335 (CLOUDFLAR...) (CLOUDFLARENET)
19 25	34.142.175.23 34.142.175.23	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	2600:9000:27a... 2600:9000:27af:4400:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	23.106.127.56 23.106.127.56	59253 (LEASEWEB-...) (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD.)
2 3	74.118.186.107 74.118.186.107	6336 (TURN-US-ASN) (TURN-US-ASN)
1 2	52.223.2.229 52.223.2.229	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4264:e3b7:dedd:c6b:bb7b	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	52.68.127.144 52.68.127.144	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:26f... 2600:9000:26f2:6c00:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	3.164.110.98 3.164.110.98	16509 (AMAZON-02) (AMAZON-02)
2 3	2600:1901:0:8... 2600:1901:0:8eee::	15169 (GOOGLE) (GOOGLE)
4 4	142.250.196.130 142.250.196.130	15169 (GOOGLE) (GOOGLE)
1 2	34.229.3.43 34.229.3.43	14618 (AMAZON-AES) (AMAZON-AES)
1	52.23.38.239 52.23.38.239	14618 (AMAZON-AES) (AMAZON-AES)
1	23.2.37.89 23.2.37.89	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	18.138.15.243 18.138.15.243	16509 (AMAZON-02) (AMAZON-02)
1 2	54.71.108.129 54.71.108.129	16509 (AMAZON-02) (AMAZON-02)
1 2	35.244.154.8 35.244.154.8	15169 (GOOGLE) (GOOGLE)
1 1	142.250.196.98 142.250.196.98	15169 (GOOGLE) (GOOGLE)
1	69.173.158.64 69.173.158.64	26667 (RUBICONPR...) (RUBICONPROJECT)
1	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	54.203.236.163 54.203.236.163	16509 (AMAZON-02) (AMAZON-02)
2 6	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:140b:a00... 2600:140b:a00:e::b81d:8cdf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	13.48.36.94 13.48.36.94	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f10... 2a03:2880:f10f:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	44.238.122.172 44.238.122.172	16509 (AMAZON-02) (AMAZON-02)
3 3	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2 3	18.182.162.20 18.182.162.20	16509 (AMAZON-02) (AMAZON-02)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	52.42.124.195 52.42.124.195	16509 (AMAZON-02) (AMAZON-02)
1	52.12.117.226 52.12.117.226	16509 (AMAZON-02) (AMAZON-02)
1	44.237.157.168 44.237.157.168	16509 (AMAZON-02) (AMAZON-02)
233	72

1 172.105.230.106 (Tokyo, Japan) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1884-106.members.linode.com

401.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

60 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2600:140b:a00:396::1e80 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.179.63.210 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-179-63-210.ap-northeast-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.92.33.217 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-92-33-217.ap-northeast-1.compute.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.139.230.53 (Singapore, Singapore) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-139-230-53.ap-southeast-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.50.191 (United States)

ASN16509 (AMAZON-02, US)

fortinet.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.19.148.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 23.50.118.161 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-50-118-161.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.207.173.158 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-207-173-158.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wave.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.87.122.136 (Singapore, Singapore)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 136.122.87.34.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2404:6800:4004:818::2008 (Australia)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 38.133.127.191 (Sacramento, United States)

ASN22075 (AS-OUTBRAIN, US)

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:1c00:39::1732:7614 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.9.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 43.202.117.154 (Incheon, Korea, Republic Of)

ASN16509 (AMAZON-02, US)
PTR: ec2-43-202-117-154.ap-northeast-2.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:52e0:1501::1193:1 (Japan)

ASN200325 (BUNNYCDN, SI)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4004:823::200e (Australia)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:2af8 (United States)

ASN13335 (CLOUDFLARENET, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1247 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.32.164.86 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-164-86.us-west-2.compute.amazonaws.com

abm-tracking.demandscience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:bdf::46 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

tmp.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixels.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
webtracker.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.121.140.211 (Reston, United States)

ASN30419 (PAEDAE-INC, US)

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.42.136 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s45-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:4004:825::2002 (Australia)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.26.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bom05s09-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
10104846.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.42.162 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s46-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.226.187.177 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-226-187-177.us-west-2.compute.amazonaws.com

intentstream.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.161.34 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s23-in-f2.1e100.net

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.196.132 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s36-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.76.131 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: kix07s06-in-f3.1e100.net

www.google.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.88.179.26 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-88-179-26.us-west-2.compute.amazonaws.com

dx.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.228.157 (San Francisco, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.43.90.19 (Singapore, Singapore) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.43.89.4 (Singapore, Singapore) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2751:3600:12:dfa9:e200:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.inzynk.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.31.5 (Tokyo, Japan)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-nrt1.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.163.237 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 34.142.175.23 (Singapore, Singapore) 19 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 23.175.142.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:27af:4400:1b:5138:8a40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.106.127.56 (Singapore, Singapore)

ASN59253 (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD., SG)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 74.118.186.107 (Serangoon New Town, Singapore) 2 redirects

ASN6336 (TURN-US-ASN, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.223.2.229 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ade9ecc7904667038.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4264:e3b7:dedd:c6b:bb7b (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.68.127.144 (Tokyo, Japan) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-68-127-144.ap-northeast-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26f2:6c00:19:fc2c:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.164.110.98 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-3-164-110-98.nrt12.r.cloudfront.net

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbid.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.196.130 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s36-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.229.3.43 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-229-3-43.compute-1.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.23.38.239 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-23-38-239.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.2.37.89 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-2-37-89.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.138.15.243 (Singapore, Singapore) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-138-15-243.ap-southeast-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.71.108.129 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-71-108-129.us-west-2.compute.amazonaws.com

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.196.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s35-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.158.64 (Singapore, Singapore)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.203.236.163 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-236-163.us-west-2.compute.amazonaws.com

tracking.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.117.77.79 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:a00:e::b81d:8cdf (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.48.36.94 (Stockholm, Sweden)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-48-36-94.eu-north-1.compute.amazonaws.com

6033413.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f10f:83:face:b00c:0:25de (Tokyo, Japan)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.238.122.172 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-238-122-172.us-west-2.compute.amazonaws.com

44.238.122.172	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.223.40.198 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.182.162.20 (Tokyo, Japan) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-182-162-20.ap-northeast-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.42.124.195 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-42-124-195.us-west-2.compute.amazonaws.com

px.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.12.117.226 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-12-117-226.us-west-2.compute.amazonaws.com

gs.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.237.157.168 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-237-157-168.us-west-2.compute.amazonaws.com

px.steelhousemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
61	fortinet.com www.fortinet.com — Cisco Umbrella Rank: 115924 metrics.fortinet.com — Cisco Umbrella Rank: 284311	5 MB
27	simpli.fi 19 redirects tag.simpli.fi — Cisco Umbrella Rank: 4944 i.simpli.fi — Cisco Umbrella Rank: 4294 um.simpli.fi — Cisco Umbrella Rank: 934	15 KB
22	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 452	151 KB
15	doubleclick.net 6 redirects td.doubleclick.net — Cisco Umbrella Rank: 189 ad.doubleclick.net — Cisco Umbrella Rank: 153 googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 10104846.fls.doubleclick.net — Cisco Umbrella Rank: 296118 cm.g.doubleclick.net — Cisco Umbrella Rank: 284	9 KB
15	6sc.co j.6sc.co — Cisco Umbrella Rank: 5691 c.6sc.co — Cisco Umbrella Rank: 7155 ipv6.6sc.co — Cisco Umbrella Rank: 5832 b.6sc.co — Cisco Umbrella Rank: 3516	22 KB
10	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2506 tracking.crazyegg.com — Cisco Umbrella Rank: 4420	79 KB
9	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	845 KB
6	ml314.com 2 redirects ml314.com — Cisco Umbrella Rank: 1751	40 KB
6	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	127 KB
5	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 479 ib.adnxs.com — Cisco Umbrella Rank: 270	5 KB
5	outbrain.com amplify.outbrain.com — Cisco Umbrella Rank: 3422 tr.outbrain.com — Cisco Umbrella Rank: 3354 wave.outbrain.com — Cisco Umbrella Rank: 3410	10 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 327 px4.ads.linkedin.com — Cisco Umbrella Rank: 6795	2 KB
4	mountain.com dx.mountain.com — Cisco Umbrella Rank: 5047 px.mountain.com — Cisco Umbrella Rank: 5170 gs.mountain.com — Cisco Umbrella Rank: 9611	11 KB
4	google.co.jp www.google.co.jp — Cisco Umbrella Rank: 26138	256 B
4	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 3	216 B
4	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 256 fortinet.demdex.net — Cisco Umbrella Rank: 308668	2 KB
3	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1085	2 KB
3	adsrvr.org 3 redirects match.adsrvr.org — Cisco Umbrella Rank: 382	2 KB
3	crwdcntrl.net 2 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 989 sync.crwdcntrl.net — Cisco Umbrella Rank: 915	799 B
3	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2630 pbid.pro-market.net — Cisco Umbrella Rank: 12335	1 KB
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 932	842 B
3	t.co t.co — Cisco Umbrella Rank: 834	2 KB
3	contanuity.com intentstream.contanuity.com — Cisco Umbrella Rank: 58667 tracking.contanuity.com — Cisco Umbrella Rank: 19503	1 KB
3	argusplatform.com tmp.argusplatform.com — Cisco Umbrella Rank: 299240 pixels.argusplatform.com — Cisco Umbrella Rank: 299605 webtracker.argusplatform.com — Cisco Umbrella Rank: 306518	4 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 28371 ibc-flow.techtarget.com — Cisco Umbrella Rank: 25060	2 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 361	15 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 106	4 KB
2	rlcdn.com 1 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 476	528 B
2	lijit.com 1 redirects ce.lijit.com — Cisco Umbrella Rank: 943	895 B
2	exelator.com 1 redirects loadm.exelator.com — Cisco Umbrella Rank: 2052	3 KB
2	intentiq.com 1 redirects sync.intentiq.com — Cisco Umbrella Rank: 1035	2 KB
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 544 d.agkn.com — Cisco Umbrella Rank: 777	1 KB
2	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 467	1 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 424	970 B
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 509	730 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 178	71 KB
2	demandscience.com abm-tracking.demandscience.com — Cisco Umbrella Rank: 56454	3 KB
2	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 6393 api.omappapi.com — Cisco Umbrella Rank: 6510	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 8883	718 B
1	steelhousemedia.com px.steelhousemedia.com — Cisco Umbrella Rank: 12708	319 B
1	siteimproveanalytics.io 6033413.global.siteimproveanalytics.io — Cisco Umbrella Rank: 257361	149 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 782	14 KB
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 526	264 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 414	1 KB
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 91	23 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 1278	445 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1589	421 B
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6782	175 B
1	unrulymedia.com sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1217	378 B
1	smartadserver.com rtb-csync.smartadserver.com — Cisco Umbrella Rank: 780	659 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 676	539 B
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3837	12 KB
1	inzynk.io tags.inzynk.io — Cisco Umbrella Rank: 200853	443 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 875	15 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 314	15 KB
1	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 2662	712 B
1	opmnstr.com a.opmnstr.com — Cisco Umbrella Rank: 33929	18 KB
1	omtrdc.net fortinet.tt.omtrdc.net — Cisco Umbrella Rank: 295805	840 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1463	503 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 491	314 B
1	401.tw 1 redirects 401.tw	297 B
0	krxd.net Failed usermatch.krxd.net Failed
233	63

	Domain	Requested by
60	www.fortinet.com	www.fortinet.com
25	um.simpli.fi	19 redirects
22	assets.adobedtm.com	cdn.cookielaw.org assets.adobedtm.com
12	b.6sc.co	www.fortinet.com
9	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com abm-tracking.demandscience.com
6	ml314.com	2 redirects www.fortinet.com ml314.com
6	script.crazyegg.com	www.fortinet.com script.crazyegg.com
6	cdn.cookielaw.org	www.fortinet.com cdn.cookielaw.org
4	cm.g.doubleclick.net	4 redirects
4	www.google.co.jp	www.fortinet.com
4	www.google.com	1 redirects www.fortinet.com
4	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
4	td.doubleclick.net	www.googletagmanager.com
4	tracking.crazyegg.com	script.crazyegg.com
3	px.ads.linkedin.com	1 redirects snap.licdn.com
3	ps.eyeota.net	2 redirects
3	match.adsrvr.org	3 redirects
3	analytics.twitter.com
3	t.co
3	ib.adnxs.com	1 redirects
3	bat.bing.com	assets.adobedtm.com bat.bing.com www.fortinet.com
3	dpm.demdex.net	www.fortinet.com
2	px.mountain.com	dx.mountain.com px.mountain.com
2	www.facebook.com
2	idsync.rlcdn.com	1 redirects
2	ce.lijit.com	1 redirects
2	bcp.crwdcntrl.net	1 redirects
2	loadm.exelator.com	1 redirects
2	fei.pro-market.net	2 redirects
2	sync.intentiq.com	1 redirects
2	pixel.tapad.com	1 redirects
2	eb2.3lift.com	1 redirects
2	sync.1rx.io	2 redirects
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	10104846.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	secure.adnxs.com	1 redirects
2	intentstream.contanuity.com	abm-tracking.demandscience.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	abm-tracking.demandscience.com	www.fortinet.com abm-tracking.demandscience.com
2	www.google-analytics.com	www.googletagmanager.com
2	epsilon.6sense.com	j.6sc.co
2	tr.outbrain.com	amplify.outbrain.com
2	amplify.outbrain.com	www.fortinet.com amplify.outbrain.com
1	px.steelhousemedia.com
1	gs.mountain.com	px.mountain.com
1	px4.ads.linkedin.com
1	sync.crwdcntrl.net	1 redirects
1	6033413.global.siteimproveanalytics.io
1	snap.licdn.com	www.fortinet.com
1	webtracker.argusplatform.com	tmp.argusplatform.com
1	tracking.contanuity.com	abm-tracking.demandscience.com
1	us-u.openx.net
1	pixel.rubiconproject.com
1	www.googleadservices.com	1 redirects
1	stags.bluekai.com
1	sync.bfmio.com
1	pbid.pro-market.net
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.targeting.unrulymedia.com
1	rtb-csync.smartadserver.com
1	s.ad.smaato.net	1 redirects
1	siteimproveanalytics.com	assets.adobedtm.com
1	tags.inzynk.io	assets.adobedtm.com
1	static.ads-twitter.com	www.fortinet.com
1	dx.mountain.com	www.fortinet.com
1	i.simpli.fi	tag.simpli.fi
1	cdn.jsdelivr.net	abm-tracking.demandscience.com
1	pixels.argusplatform.com	tmp.argusplatform.com
1	ad.doubleclick.net	www.fortinet.com
1	pixel.mathtag.com	www.fortinet.com
1	tmp.argusplatform.com	www.fortinet.com
1	trk.techtarget.com	www.fortinet.com
1	api.omappapi.com	a.opmnstr.com
1	a.omappapi.com	a.opmnstr.com
1	a.opmnstr.com	assets.adobedtm.com
1	metrics.fortinet.com	www.fortinet.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	wave.outbrain.com	amplify.outbrain.com
1	tag.simpli.fi	assets.adobedtm.com
1	j.6sc.co	www.fortinet.com
1	fortinet.tt.omtrdc.net	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	www.fortinet.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	401.tw	1 redirects
0	usermatch.krxd.net Failed
233	89

This site contains links to these domains. Also see Links.

Domain
github.com
nvd.nist.gov
geoserver.org
www.cisa.gov
www.fortiguard.com
attack.mitre.org
training.fortinet.com
www.linkedin.com
www.twitter.com
www.youtube.com
www.instagram.com
www.facebook.com
fortiguard.com
community.fortinet.com
investor.fortinet.com
onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-16` - `2025-07-15`	a year	crt.sh
cookielaw.org WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
script.crazyegg.com Cloudflare Inc ECC CA-3	`2024-08-02` - `2024-12-31`	5 months	crt.sh
6sc.co R11	`2024-07-03` - `2024-10-01`	3 months	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-14` - `2024-12-14`	a year	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-04-04` - `2025-05-04`	a year	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-06-21` - `2025-07-20`	a year	crt.sh
metrics.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-26` - `2025-01-25`	a year	crt.sh
a.opmnstr.com R10	`2024-08-08` - `2024-11-06`	3 months	crt.sh
a.omappapi.com R10	`2024-08-08` - `2024-11-06`	3 months	crt.sh
omappapi.com WE1	`2024-08-14` - `2024-11-12`	3 months	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
abm-tracking.demandscience.com R10	`2024-08-14` - `2024-11-12`	3 months	crt.sh
tmp.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
*.mathtag.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-04-23` - `2025-04-30`	a year	crt.sh
ibc-flow.techtarget.com WR3	`2024-08-28` - `2024-11-26`	3 months	crt.sh
*.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
pixels.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-08` - `2025-03-08`	6 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
intentstream.contanuity.com E6	`2024-08-15` - `2024-11-13`	3 months	crt.sh
*.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.google.co.jp WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.mountain.com Go Daddy Secure Certificate Authority - G2	`2024-05-23` - `2025-06-24`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
*.inzynk.io Amazon RSA 2048 M02	`2024-01-07` - `2025-02-04`	a year	crt.sh
t.co E6	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-02` - `2024-10-31`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-29` - `2024-09-27`	3 months	crt.sh
siteimproveanalytics.com WE1	`2024-08-19` - `2024-11-17`	3 months	crt.sh
tracking.contanuity.com R11	`2024-09-11` - `2024-12-10`	3 months	crt.sh
webtracker.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-08-21` - `2024-11-19`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.global.r1.siteimproveanalytics.io Amazon RSA 2048 M03	`2024-09-02` - `2025-10-01`	a year	crt.sh
44.238.122.172 Sectigo RSA Domain Validation Secure Server CA	`2024-08-05` - `2025-08-20`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-09-11` - `2025-03-11`	6 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Frame ID: B40488A9171B8F8A4D6262D965BCFEEE
Requests: 224 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 7D0AD57FCF687B2D109BBC1554011F82
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=1777323958.1726838133;ps=1;pcor=1919840651;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9191763579;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Frame ID: BA606D559EEE5D306A896926FD01F554
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/662878185?random=1726838133467&cv=11&fst=1726838133467&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: DE0A8EF47E8D01D98221FB74ABAA73E3
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/609297413?random=1726838133721&cv=11&fst=1726838133721&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 2FBF3E5EE79FB298B85F778ABF4A70E0
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/729495989?random=1726838133818&cv=11&fst=1726838133818&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: AA55451B286B72F73B2FF0D233F8A0D8
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=CKy5hK3N0YgDFZdZDwIdl24lgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1963360059513.315
Frame ID: C5A18788B4DBBFCCAD88453DB67FC1E1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401 | FortiGuard Labs

Page URL History Show full URLs

https://401.tw/Mr6E HTTP 307
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-... Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

FingerprintJS (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/fingerprintjs@(\d)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

233
Requests

86 %
HTTPS

28 %
IPv6

63
Domains

89
Subdomains

72
IPs

7
Countries

6970 kB
Transfer

11081 kB
Size

111
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/geoserver/geoserver
Title: open-source software

Search URL Search Domain Scan URL

URL: https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
Title: advisory

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36401
Title: CVE-2024-36401

Search URL Search Domain Scan URL

URL: https://geoserver.org/announcements/vulnerability/2024/06/18/geoserver-2-25-2-released.html
Title: addressed

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/alerts/2024/07/15/cisa-adds-one-known-exploited-vulnerability-catalog
Title: added

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/encyclopedia/ips/56197
Title: IPS signature

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/groups/G0096/
Title: APT41

Search URL Search Domain Scan URL

URL: https://github.com/fatedier/frp
Title: Fast Reverse Proxy

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/groups/G0059/
Title: Magic Hound

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
Title: Fox Kitten

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
Title: Volt Typhoon

Search URL Search Domain Scan URL

URL: https://training.fortinet.com/local/staticpage/view.php?page=fcf_cybersecurity
Title: Fortinet Certified Fundamentals (FCF) in Cybersecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fortinet/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://community.fortinet.com/
Title: Fortinet Community

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://401.tw/Mr6E HTTP 307
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 69

https://cm.everesttech.net/cm/dd?d_uuid=41693660238315688000305167721532418661 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11cwAAAKK_QQN1

Request Chain 168

https://secure.adnxs.com/px?id=1773420&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Request Chain 169

https://ib.adnxs.com/seg?add=36113683 HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Request Chain 176

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1963360059513.315 HTTP 302
https://10104846.fls.doubleclick.net/activityi;dc_pre=CKy5hK3N0YgDFZdZDwIdl24lgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1963360059513.315

Request Chain 181

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=98F335567E784DE4B818938C71A8A5CC HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=133&partneruserid=6499164f1c&gdpr=0&gdpr_consent=

Request Chain 182

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/98F335567E784DE4B818938C71A8A5CC HTTP 302
https://sync.1rx.io/usersync/simplifi/98F335567E784DE4B818938C71A8A5CC?zcc=1&cb=1726838135695 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-eeb83afc-6957-463d-88ab-ad072def41b0-004

Request Chain 183

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=98F335567E784DE4B818938C71A8A5CC&dongle=yf3 HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=98F335567E784DE4B818938C71A8A5CC&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

Request Chain 184

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=98F335567E784DE4B818938C71A8A5CC

Request Chain 185

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=98F335567E784DE4B818938C71A8A5CC HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=98F335567E784DE4B818938C71A8A5CC

Request Chain 186

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=98F335567E784DE4B818938C71A8A5CC HTTP 302
https://d.agkn.com/pixel/10751/?che=1726838135600&ip=146.70.201.218&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D231823305011003804166 HTTP 302
https://um.simpli.fi/aa_px?sk=231823305011003804166 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 187

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=98F335567E784DE4B818938C71A8A5CC HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=98F335567E784DE4B818938C71A8A5CC&ckls=true&ci=RU1OFjWb2Q&nc=false&trid=1494116343

Request Chain 190

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=98F335567E784DE4B818938C71A8A5CC;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=98F335567E784DE4B818938C71A8A5CC;mimetype=img;sr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datonics-ddp&google_cm&google_hm=LTkwMjkxMzA2NzQ0NTM0NjI0Nzg= HTTP 302
https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEOldn0wlwC08_nQOyafyfgQ&google_cver=1

Request Chain 191

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=98F335567E784DE4B818938C71A8A5CC&j=0 HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=98F335567E784DE4B818938C71A8A5CC&j=0&xl8blockcheck=1

Request Chain 193

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=98F335567E784DE4B818938C71A8A5CC

Request Chain 194

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=98F335567E784DE4B818938C71A8A5CC

Request Chain 195

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=98F335567E784DE4B818938C71A8A5CC HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=98F335567E784DE4B818938C71A8A5CC

Request Chain 196

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=98F335567E784DE4B818938C71A8A5CC HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=98F335567E784DE4B818938C71A8A5CC&dnr=1

Request Chain 197

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=98F335567E784DE4B818938C71A8A5CC HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEAbJRGcW0vNDIy0iY23YcBk&google_cver=1

Request Chain 198

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1726838134651&cv=7&fst=1726838134651&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1563756270&cv=7&fst=1726838134651&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCJvHsQI&pscrd=IhMIhO-Urc3RiAMVbpLpBR2SJho3MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=1563756270&cv=7&fst=1726838134651&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCJvHsQI&pscrd=IhMIhO-Urc3RiAMVbpLpBR2SJho3MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfkKcNf_CPYSS5ejbJuiui1ycIteITS5YE1F4g-POZV0ydW7e0&random=1669458984 HTTP 302
https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=1563756270&cv=7&fst=1726838134651&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCJvHsQI&pscrd=IhMIhO-Urc3RiAMVbpLpBR2SJho3MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfkKcNf_CPYSS5ejbJuiui1ycIteITS5YE1F4g-POZV0ydW7e0&random=1669458984&ipr=y

Request Chain 200

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=98F335567E784DE4B818938C71A8A5CC

Request Chain 201

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=98F335567E784DE4B818938C71A8A5CC&expires=365

Request Chain 202

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=98F335567E784DE4B818938C71A8A5CC

Request Chain 203

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_gid=CAESEAxr0A31rRkikbiPMIphVc4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=98F335567E784DE4B818938C71A8A5CC HTTP 302
https://um.simpli.fi/g_match?id=

Request Chain 217

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&gdpr=0&gdpr_consent=

Request Chain 218

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3647144422797738056 HTTP 302
https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144422797738056

Request Chain 219

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=24-vEWlYqGiG8W-kJ6bdu7DPZPRhnptwz_R4bJ9qBByY&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ml314.com/csync.ashx?fp=24-vEWlYqGiG8W-kJ6bdu7DPZPRhnptwz_R4bJ9qBByY&person_id=3647144422797738056&eid=50052&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

Request Chain 221

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838135812&li_adsId=caed7681-708e-48fb-a5ba-6138ac1612a3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838135812&li_adsId=caed7681-708e-48fb-a5ba-6138ac1612a3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&e_ipv6=AQJKQ5349KwTjwAAAZIPkty4nHST9YFPdQsEqNVknUb7R25TwQmvAqegVx1Zv3DefVjSXw

Request Chain 222

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838134717 HTTP 303
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838134717&_bee_ppp=1 HTTP 303
https://tracking.contanuity.com/usersync?bwcookie=AAFiGU7N2usAABSEM6DVvA

Request Chain 228

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=6ca2165b-7752-11ef-8b02-814c35b12fb6&gdpr=&gdpr_consent= HTTP 302
https://px.steelhousemedia.com/tdsync?tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&shguid=6ca2165b-7752-11ef-8b02-814c35b12fb6

Request Chain 229

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://tags.bluekai.com/site/5386?id=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YWNmYjdkYjUtMGEwMC00YWM0LThmMzAtYTFjZDEzYTVkYTY2&gdpr=0&gdpr_consent=&ttd_tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66 HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&google_gid=CAESECL1XExDpWnJgbjwjz_GYv8&google_cver=1 HTTP 302
https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66

233 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request threat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Show response
www.fortinet.com/blog/threat-research/
Redirect Chain

https://401.tw/Mr6E
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

103 KB
29 KB

868ms
78ms

Document
text/html

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

3d6bc3dbcf9e2cf02f556ae8bd0936e8b62540189823df29c4f524c060bb8328

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Age: 86711
Cache-Control: max-age=600, public, s-maxage=10800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 27960
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Type: text/html;charset=utf-8
Date: Fri, 20 Sep 2024 13:14:57 GMT
ETag: "19b93-62278a4ad0fc7-gzip"
Last-Modified: Thu, 19 Sep 2024 13:10:14 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 6si80gTfrIIdK0AoKm_3_lpHFfy5-0z7Zvw_3GOa82md0iu8J9nIXA==
X-Amz-Cf-Pop: SIN2-P4
X-Cache: Hit from cloudfront
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher1uswest1-28559594
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 142
Content-Type: text/html; charset=utf-8
Date: Fri, 20 Sep 2024 13:15:25 GMT
Location: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Server: nginx/1.26.1

GET
H/1.1 200
OK visitorapi.min.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 64 KB
30 KB 75ms
73ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "fe2d-6117284c96900-gzip"
Age: 330531
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 8fCA6CnALQcXcA-EDAMk-6w_0YCIqUP8XOz2OZwPesZzvgCHTNyOow==
Date: Mon, 16 Sep 2024 17:27:27 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 15 Feb 2024 21:43:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29532
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK at.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 104 KB
48 KB 220ms
77ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "19e83-61431fc4b24c0-gzip"
Age: 330492
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: szVP35YBebcnO27W-_QSi-yixY7cjfB4WaMsIUji3XMiCEF4DCoR1g==
Date: Mon, 16 Sep 2024 17:27:28 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 21 Mar 2024 20:59:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47782
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 540 KB
28 KB 161ms
75ms Stylesheet
text/css 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "86e1b-61b58998583c0-gzip"
Age: 5164004
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ySWTmt-5L3gjieguG8c4XqSauk8eT2AnKnXf01Mbi33jwHZHSKrxiQ==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: text/css;charset=utf-8
Last-Modified: Thu, 20 Jun 2024 21:00:07 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27478
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 116ms
21ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: jwlUUXc1HMPClYXMpY+NPQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCD8180F629235
x-ms-lease-status: unlocked
age: 62228
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 19:58:18 GMT
date: Fri, 20 Sep 2024 13:15:26 GMT
content-type: application/javascript
last-modified: Wed, 18 Sep 2024 19:28:22 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-ms-request-id: 6758b5e5-201e-0098-0fc4-0a1db5000000
cf-ray: 8c621594acac80ff-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6881
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 221ms
79ms Image
image/svg+xml 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 34042445
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 4ZXVtjp6sNEHxXNb19Guqkyo227WpJMUG3nU_PEHjFSmGoinbIKGUg==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 6e88e2758d60d31557bd6a2743570ed0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
3 KB 218ms
76ms Image
image/jpeg 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "4fd-60a2031eb4f40"
Age: 26854862
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 0I7B173vWfVDKlVckvAW3sgNJ6slxvkVmBYTDNWqLfAwhZiTgImkHQ==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 160 KB
74 KB 81ms
80ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "28100-61cff12ce1d80-gzip"
Age: 5164003
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: JqAQjOQCKnT2sxsaMRlzZb55s-VW4s4TxEjTtxI6EGmV5-KfAE8Vqg==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: application/javascript;charset=utf-8
Vary: Accept-Encoding
Last-Modified: Thu, 11 Jul 2024 21:01:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 6e88e2758d60d31557bd6a2743570ed0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 74768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 5 KB
2 KB 63ms
42ms XHR
application/x-javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Uj3iBUKm1Vl2g2NHq67V+w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF23DF5130
age: 74531
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 21 Sep 2024 13:15:27 GMT
date: Fri, 20 Sep 2024 13:15:27 GMT
content-type: application/x-javascript
last-modified: Thu, 28 Dec 2023 19:56:54 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-ms-request-id: c21183be-301e-00a5-5054-cda893000000
cf-ray: 8c621595a96280d8-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1792
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
1 KB 78ms
77ms Image
image/svg+xml 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 34042446
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: FRdEioSBbxaXkv7OmIrR7lLFDymbx6sJWVFp0zREcdzOtf6ES_e6Kg==
Date: Fri, 20 Sep 2024 13:15:27 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK geoserver-hero.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 370 KB
372 KB 74ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/geoserver-hero.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

83201017e411b72434080a221b102049e9074e205d97f65219d2286abd683012

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "5c8ee-621505f67c380"
Age: 1296316
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 0qiSTH6cSgK-Vf1dpaSOsAm6CdYP9OD9TjpxoLf6DNI9d1od4m4Tag==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 19:42:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 379118
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK chavecloak-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 37 KB
39 KB 80ms
80ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/chavecloak-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

fd9f918bd5a22813d48748b8c79e2acaeeb590d217575e0d79d734cba9de7736

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "9490-611dcced7f240"
Age: 14248955
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: bz6_ikFTobTRbBRevsw6TtnkfXtgu0Mvql3lhE2OXgkOg8NwfvYVNA==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/png
Last-Modified: Wed, 21 Feb 2024 04:32:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 894f321aaec7e16111835f5b53fa21a4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 38032
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK scrubcrypt-24-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 43 KB
44 KB 103ms
72ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/scrubcrypt-24-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

2eceae481c2cda87ecdc8e65c8bbd62ddc9538144c42ff6c1cd720cd5781623c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "ab05-6155cc8f5f240"
Age: 14245029
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 0B498grrd8ZutD5RIHKYhF24LSvnQXDurfGq6p_zy1vZCF4QlkUiPA==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Fri, 05 Apr 2024 17:28:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 43781
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK lumma-variant-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 46 KB
48 KB 92ms
72ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/lumma-variant-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

11c69167edad4aa2ac0c3def81f10e2caf7375ca37d9170e9277ac2cef39eb32

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "b8c6-60dff3ae26100"
Age: 22103922
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: o7M_hdzDpnAuMtmVUPPHoP_OViQnKt_S7Z5_LlVy8BzuPa0shzSw7Q==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Tue, 02 Jan 2024 23:55:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47302
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
38 KB 174ms
96ms Font
application/octet-stream 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Response headers

X-Vhost: publish
ETag: "9354-5df4fa74ff980"
Age: 330568
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: hFDHZFljelcej3JIAQIv8oRsYypVWv5ZVSGmftduGNFTrkKTK3D1fw==
Date: Mon, 16 Sep 2024 17:27:32 GMT
Content-Type: application/octet-stream
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37716
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
314 B 293ms
24ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

291ac3898f3f28bd32810a5ef0f380363afee480e535632f0254da751f775c63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8c6215a0ecf5e0a8-NRT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:28 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H/1.1 200
OK fig01-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1725493359930/ 61 KB
62 KB 100ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1725493359930/fig01-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6bb4e76fdeac3f86fe514013ea4ec43b69cf824a9cb00b4d90ca33eb27df3712

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "f3de-62153bab9b9c0"
Age: 1283694
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: _kmHBxmXN_baHgydwuJELKf6Zvq3_pE3nwuHmGiiubzmuCX7sJkugg==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 62430
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK fig02-geoserver-script-file-remote-sh.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_542065486.img.png/1725493737369/ 449 KB
451 KB 111ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_542065486.img.png/1725493737369/fig02-geoserver-script-file-remote-sh.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9cbf9589d98422a08f788b3863a74d1a27c3d92289f8829620c4d8925b967b94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "70532-62153d1418c40"
Age: 1284574
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: sIXl5BdD2WlOf2CfP_ldgNkwlAiLmyTJgmHYUzGKv5MjdVS3k53Xyg==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:48:57 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 460082
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig03-geoserver-gorevese.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_992669665.img.png/1725493760506/ 50 KB
51 KB 112ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_992669665.img.png/1725493760506/fig03-geoserver-gorevese.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

38cfaeb6a3cb2cff2b9b11f9945838fd640ac7c0483e093239a29400c7d2ee66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "c6c1-62153d2a08000"
Age: 1284646
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: bF9tDOC0kmGHRd7l1Y4UoM1j5QEWOF5HAJCLjgWMHBvA0wyNU1SvLQ==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:49:20 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 894f321aaec7e16111835f5b53fa21a4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 50881
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig04-geoserver-goreverse-log.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_744399015.img.png/1725493351601/ 265 KB
267 KB 111ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_744399015.img.png/1725493351601/fig04-geoserver-goreverse-log.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

07405b002bac345765f6de032ed07cac28e77745e73850bf4aed8f891822c37a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "42511-62153ba3fa7c0"
Age: 1284646
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: iwKFthPbwiVNIoqrUrSel57I8yUCrMRhZU-k8z940tNRXSMScxRprg==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 6e88e2758d60d31557bd6a2743570ed0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 271633
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig05-geoserver-goreverse-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_963623453.img.png/1725493337854/ 75 KB
76 KB 112ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_963623453.img.png/1725493337854/fig05-geoserver-goreverse-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

4713f4e99bebe488012bb9f5ccbaa25d83f2ecec4dbfc2c71f81ad33df9d1c10

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "12a2b-62153b96a0840"
Age: 1284574
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: rJLQSd5V4AucbaJDxZHU-hcymX1lJxC9u8JMC_WBPG2LgMLWRgz14w==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 76331
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig06-geoserver-script-file-d.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1712359983.img.png/1725493331271/ 185 KB
187 KB 114ms
78ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1712359983.img.png/1725493331271/fig06-geoserver-script-file-d.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f188b1683849ebab2c42aa623674d573d89c3a8b8a533f4e2ec35fe7a9e8000e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "2e589-62153b90e7ac0"
Age: 1283694
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: D927auZGh-2B5LHxNDCmt6ebSV__A7FU3joqQLR_FiHtAIpRElzC7A==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:11 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 189833
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig07-geoserver-creating-folders.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_219608780.img.png/1725493380912/ 113 KB
115 KB 125ms
124ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_219608780.img.png/1725493380912/fig07-geoserver-creating-folders.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

706300e054788f930de76af585fc6511091289d01c65c440964ca6abb898e7dc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1c505-62153bbfa2900"
Age: 1284645
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: UidPfpudGy4cY-TXICCI3flBUUIR6XT4jMH0toTfHx9xg5yIlzTPww==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 115973
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig08-geoserver-xor-decoded-0x60.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_359750668.img.png/1725509365855/ 115 KB
117 KB 112ms
110ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_359750668.img.png/1725509365855/fig08-geoserver-xor-decoded-0x60.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

c6c7eafdd4ce7cbca90175e42e4d11a9ebcfaed70b6471572a0d3d0ae7dde57f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1cd07-6215774c1e740"
Age: 1284574
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: QZ2OitoYXLc1gYH_EONgMTAtG5nCl399PZJVUBzjBXHMNrhTZc-HPg==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:09:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 894f321aaec7e16111835f5b53fa21a4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 118023
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig09-geoserver-saved-decoded-files.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1078076399.img.png/1725493420288/ 33 KB
35 KB 89ms
87ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1078076399.img.png/1725493420288/fig09-geoserver-saved-decoded-files.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b133508601dd82610cda75ed20bc034dd90b459dcd74b8b44e75998e38d19477

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "85a6-62153be5c8300"
Age: 15186
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: nxgjxXFOIVYvudVqQbT418z6tFuFCCk5klmcASasoXqwYkA9nfHBzA==
Date: Fri, 20 Sep 2024 09:02:23 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:40 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 34214
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig10-geoserver-xor-decoded-0x89.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1956682136.img.png/1725493436943/ 131 KB
133 KB 82ms
78ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1956682136.img.png/1725493436943/fig10-geoserver-xor-decoded-0x89.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5b7b4be8ed582776a1ad52eed0fe06afe968c34e31d566c473feb92ac6a270e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "20cd5-62153bf50a700"
Age: 1283694
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: laSBr26Jo3kBeGFI8_XjiiZS0x73j7LxMUH2q1cOX99q_lkTtTKeRg==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:56 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 134357
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig11-geoserver-decrypted-configuration-chacha20.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1654479811.img.png/1725493462325/ 41 KB
42 KB 75ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1654479811.img.png/1725493462325/fig11-geoserver-decrypted-configuration-chacha20.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

44fc655655fedce3141e358eabb02c39e838d48e6643b1c58c395adfc23757d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "a2f9-62153c0dd6180"
Age: 1283694
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: yJRWh6ZiZ0ulZXmAkgssNKZXe3gGULcSf055o_Jio5fyrDFfOFWObA==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:44:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 41721
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig12-geoserver-encrypted-binary.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_881935709.img.png/1725493495125/ 160 KB
161 KB 102ms
95ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_881935709.img.png/1725493495125/fig12-geoserver-encrypted-binary.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2ac7d5402f2266e77a525cf70164ad40fb86b0981530cad5af3e3610a209768

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "27ee7-62153c2d4ebc0"
Age: 1284644
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: vGNKJWFONR1XVgOM2BABU9J3twNHCosio5N5PW654MILLQaZOuiBwQ==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:44:55 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 163559
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig13-geoserver-decrypted-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2093410339.img.png/1725493500451/ 121 KB
122 KB 325ms
309ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2093410339.img.png/1725493500451/fig13-geoserver-decrypted-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e8f00eb416ad5af6f4524e1b7efd086a2244bf48757eee0fbdf583c20afa1dad

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1e310-62153c3213700"
Age: 1284575
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 4PTUjRFHr41aqKgqwQ6E44cc7YAr7oK98MaO_lLoo405d17a7XKOUw==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 123664
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig14-geoserver-packet-capture-c2-connection.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1728308731.img.png/1725493517259/ 138 KB
140 KB 325ms
309ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1728308731.img.png/1725493517259/fig14-geoserver-packet-capture-c2-connection.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9ae293c59bba08f1a56f697a11015ee4b251b0f38c309f83c80d7f6e7369caa4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "229ef-62153c4249d40"
Age: 1284574
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: PkxfqhYWhprB-w-51VuVZL2ZwT5NNsJ3bF0HVeDsVqj2TeBrCrH0xQ==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 894f321aaec7e16111835f5b53fa21a4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 141807
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig15-geoserver-c2-communication.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1929634219.img.png/1725493533356/ 71 KB
73 KB 78ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1929634219.img.png/1725493533356/fig15-geoserver-c2-communication.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

89905a0e0efe1119d95b1e69de27157b35b8043115708fa06eb74dc706568a7b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "11cc6-62153c518c140"
Age: 1284645
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 8lDDf3rLwR2rBNXoLxf4XFGRf11j1Zw4CEeWINaDMkdw_wN9buq3wg==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 6e88e2758d60d31557bd6a2743570ed0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 72902
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig16-geoserver-fpr-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1939040249.img.png/1725509412346/ 129 KB
130 KB 78ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1939040249.img.png/1725509412346/fig16-geoserver-fpr-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

fd688f7a638dad7a8d7c394f5443ed8ccb3158d4555937c1e0f51546b2fc9612

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "20403-62157778f1100"
Age: 1284645
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: fK4BhdbMyKI_6ms0z0mk2Peet_6urG-06vglzQOsrHMO2_IHx_wyjg==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:10:12 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 132099
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig17-geoserver-packet-capture-fpr.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_763250428.img.png/1725509429420/ 106 KB
108 KB 106ms
103ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_763250428.img.png/1725509429420/fig17-geoserver-packet-capture-fpr.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

609ca44aa6a92944559e4d17e84e29651b391c6c3438184474fd67e602250e7d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1a98f-6215778927740"
Age: 1283694
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: cN0goGsZ8eCGu5BfJuKOf3KzOgdzN4d27jJ7Y2WgQYz_aBOG-d54aQ==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:10:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 108943
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig18-geoserver-telemetry.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_44410991.img.png/1725493592407/ 93 KB
94 KB 192ms
176ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_44410991.img.png/1725493592407/fig18-geoserver-telemetry.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8d121b33124fce841c6927c1214d2aa4fe7e5c52629de45f68f325f749a5857d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1725d-62153c89d0600"
Age: 1284644
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 1geoOCbAYsnaSYEjB1w1iy9gju-pZnJikppz5t6xvn1pndpKmmKdTQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:46:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 894f321aaec7e16111835f5b53fa21a4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 94813
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig19-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1852080368.img.png/1725493624336/ 117 KB
119 KB 164ms
149ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1852080368.img.png/1725493624336/fig19-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ae7d18a41edd5f27e717f872a1113addddbf1553e00b3db1baefa99b68fda302

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1d5d5-62153ca854e00"
Age: 1284644
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ypZt-3mY-EDkH07x2w2k1Mi-UxE9GZXBrxVHVngEvqpbB6p0N-E71A==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:47:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 120277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig20-geoserver-xor-decoded-function.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_898199783.img.png/1725493640566/ 30 KB
32 KB 85ms
78ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_898199783.img.png/1725493640566/fig20-geoserver-xor-decoded-function.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

a4b0a228372854369707f452fb9124e5bc34319c8c3323b5379111ac9ba4bac6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "794f-62153cb797200"
Age: 24823
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: tNTJNVdHC8QjI1KHwMnBSSIr5RCrjk9NjiYLBVe-JHmHGeeZ3DyWdA==
Date: Fri, 20 Sep 2024 06:21:47 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:47:20 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 6e88e2758d60d31557bd6a2743570ed0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31055
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig21-geoserver-decoded-config-data.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_88540031.img.png/1725493799908/ 18 KB
19 KB 113ms
109ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_88540031.img.png/1725493799908/fig21-geoserver-decoded-config-data.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f2771985061ab617dd696611136d31d58dba565372eaf86c562d59d8bae3fd9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "4702-62153d4f397c0"
Age: 1284645
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: XT37Qk87oOdy5To-uwnn3txlM9BuG8eumMlbCeuIPaOKDtbdtqdJFQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:49:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 18178
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig22-geoserver-execution-msg.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2095532140.img.png/1725493821159/ 26 KB
28 KB 116ms
106ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2095532140.img.png/1725493821159/fig22-geoserver-execution-msg.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

351ba146db40e108b8dcbf0f9cc288d6cc19615020b2aeb1c0f508b79e78b93e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "69e7-62153d6434940"
Age: 1283697
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 1jHRVwfJHnFlIfRIqHtLfB0Hxx565hE7MthA2q3BS2GGfwBkov5B5Q==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:50:21 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27111
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig23-geoserver-hard-coded-payload.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1513040984.img.png/1725493835492/ 117 KB
119 KB 99ms
93ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1513040984.img.png/1725493835492/fig23-geoserver-hard-coded-payload.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5f83323b31dd79cc7f9104b638a2706b0e12b6e521f48d21ba638b67279f4417

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1d57e-62153d718e8c0"
Age: 1284645
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: VmQyq4HKgKYd76r3J8Akf1qTxfGMN3GFyG2N0B1u992EsF2Am-er4A==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:50:35 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 6e88e2758d60d31557bd6a2743570ed0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 120190
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig24-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_982915008.img.png/1725493868694/ 154 KB
155 KB 103ms
82ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_982915008.img.png/1725493868694/fig24-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8b195a98b1a9fa227dd6712c4af7ccbd807baa4a4b21491d97dbc09c1e13798a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "26815-62153d9107300"
Age: 1283697
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 8cCUDctmJ84d-wTH0eEoezr-Zktd3VeAstsMaU2pkOLroJ2Ip8QnQg==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:51:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 894f321aaec7e16111835f5b53fa21a4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 157717
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig25-geoserver-significant-string.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_903278817.img.png/1725493885710/ 27 KB
28 KB 96ms
90ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_903278817.img.png/1725493885710/fig25-geoserver-significant-string.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

2cc20824e35c6be438211ca8dcf0baa6b8e6df5473454d953a0c96d10eedae7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6a84-62153da13d940"
Age: 1284160
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: AMQzDxBeD4dYVGMkQLLFqunfiklaGg0F0xfqJXikQanxeqa2D90xQg==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:51:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27268
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig26-geoserver-continually-connecting-c2-server.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_15414132.img.png/1725493922547/ 155 KB
156 KB 92ms
86ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_15414132.img.png/1725493922547/fig26-geoserver-continually-connecting-c2-server.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6305f99e66b3ae3c375efe4b1128ab3dcdc2d66c63b97ba6b891096de9b20b9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "26a3d-62153dc486c80"
Age: 1283697
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: TWXa-SNTHxTq_B3nN6-roqRJ9N6rEjetMR8E3l-9PfQDU4i6OI468g==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:02 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 158269
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig27-geoserver-ddos-attack-methods.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_275647643.img.png/1725493939962/ 64 KB
65 KB 82ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_275647643.img.png/1725493939962/fig27-geoserver-ddos-attack-methods.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

21aaea8d55693ea73c2e3d8afbf8358f3bfa56ae0d8a0abb07221a83373da2d5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "fe15-62153dd4bd2c0"
Age: 1284644
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: oCM3BIazA1GK-a2E3urxRDQxrSgddg5J_I_Qw_PLe3fMvzn7alu1Yw==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:19 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 65045
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig28-geoserver-creating-service.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_876069744.img.png/1725493958694/ 60 KB
61 KB 91ms
87ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_876069744.img.png/1725493958694/fig28-geoserver-creating-service.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8ff6ee1950e6f70a130f69e94e575f9d5f7c5de60be4be09311deedeb91e6d61

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "f051-62153de6dbd80"
Age: 15186
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: UqLLFPEDP99u8dJ4USJWh7g22C9erjQlM1Ox2yPwFmXeYy7Ebuj4ew==
Date: Fri, 20 Sep 2024 09:02:26 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:38 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 61521
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig29-geoserver-command-execution.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_463601972.img.png/1725493975114/ 122 KB
124 KB 121ms
118ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_463601972.img.png/1725493975114/fig29-geoserver-command-execution.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

c3a522b15c8dd585c2cb4e503fdce8145d08a8eccb0e2cd7138864bba293c843

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1e99b-62153df7123c0"
Age: 1284576
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: x_4_ozchm9KbNQbkEjqwtaRERZjm5fhmxStoJGiRo-crBWlBG5sNWQ==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:55 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 125339
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig30-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_131843470.img.png/1725493991014/ 79 KB
80 KB 111ms
103ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_131843470.img.png/1725493991014/fig30-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

61c4417c2b9d4cba0069ef57a404bd5d9c7a7e4c768f57747b1c084cb9b373ce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "13af8-62153e06547c0"
Age: 1283697
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 0Pf5m-6l2GnoQF9bH72juH8BqIMFuInuUojYKUocy1Pg-FSsYXvVMA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:53:11 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 80632
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig31-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1205773152.img.png/1725494041702/ 198 KB
199 KB 110ms
107ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1205773152.img.png/1725494041702/fig31-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e708a54b75ed6fd1fe7886153e485c91697f1ab440feed4efd10262575b7e7cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "31604-62153e3603840"
Age: 1284575
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: GMmcK0Zjr_ODYNWF3Xri3UPM8IA1jXbLToDnYZEZUVk60zcnTBJSuw==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 6e88e2758d60d31557bd6a2743570ed0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 202244
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig32-geoserver-download-persistence.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1440737303.img.png/1725494062034/ 85 KB
87 KB 93ms
88ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1440737303.img.png/1725494062034/fig32-geoserver-download-persistence.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d98bf7483812de53be541b21b22b1cc519065b76ed31780f33bf8254e688812f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "155fb-62153e4a0a780"
Age: 1284643
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: afFHquHqLYagYuxDlrsHAW6tPECsMdxLLt7tU3RArIGfR2MvUx4yfg==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 87547
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig33-geoserver-coin-miner-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1886495638.img.png/1725494085500/ 108 KB
110 KB 195ms
183ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1886495638.img.png/1725494085500/fig33-geoserver-coin-miner-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6277e3210b9fb4b3b4f0d452b7f91bda534fb23f8ecbe7f9b15dcdf85626cea6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1b0fc-62153e5ff9b40"
Age: 1284576
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: L2RIKj2TnEUqf2-bZmOvpO5jPNp4a4LzVIbitlKOHqSR7oWxtIxlRQ==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 110844
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig34-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_438526620.img.png/1725494099321/ 69 KB
70 KB 166ms
150ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_438526620.img.png/1725494099321/fig34-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b124eed22afdf03abf94714c7632d5f462c0fca7725d014a4469f3b4a0f1083d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "11459-62153e6d53ac0"
Age: 1284575
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: wryWi43RVVvfwO8P1Tsh86g8zlTVB6PLzoElmM5P-hHyYliJX57cJQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 70745
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig35-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_843460720.img.png/1725509976835/ 94 KB
96 KB 104ms
89ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_843460720.img.png/1725509976835/fig35-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

0be9fc1923bfa5bd67a699ff0f49420e460c09b27bcb63dd4d682a0fa2ef5b5a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "178b4-62157992d0600"
Age: 1284576
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 6fuzmirwnrPYoG0xw1C2_pksw-wcA1ZEUzUERiHTDAb4XuMKqde4TA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:19:36 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 96436
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig36-geoserver-config-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_966339368.img.png/1725494131259/ 27 KB
28 KB 113ms
102ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_966339368.img.png/1725494131259/fig36-geoserver-config-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5072cb8f4c6522e91c53fa0b2c4a36a3aa078b5b78ac9d48f317649a055a1e1d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6c22-62153e8bd82c0"
Age: 1284576
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: TnpKPuVNqDVEsUc2cxszq7JcAXZGKlco61M_-qcP8IZk4btTey-_ug==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:55:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27682
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig37-geoserver-coin-miner.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_171562763.img.png/1725494150273/ 144 KB
145 KB 93ms
83ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_171562763.img.png/1725494150273/fig37-geoserver-coin-miner.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5b7e10ef15a4fdfd73c69fa16e91aef21861455628f5ac87e72bb5f951e9976c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "23eb3-62153e9df6d80"
Age: 1284642
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: QCt3OUvAfYjoZYv0nWb2ZBD4gADttQQy_2h9c7OBQ9KPzZJwUS97vA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:55:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 894f321aaec7e16111835f5b53fa21a4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 147123
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig38-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1859114048.img.png/1725494168657/ 175 KB
176 KB 82ms
78ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1859114048.img.png/1725494168657/fig38-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

229849a4c44505b2599f1a321b139fb5ab32d04a4e0f8d9844b1827e60b80d9f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "2bb8d-62153eaf21600"
Age: 1283698
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: PG21wvZfFKNXL-IbsNpCqPcObujnn5-uP-ro74exV4K_02NLjPJlZw==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:56:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 179085
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig39-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_444774974.img.png/1725494192518/ 74 KB
75 KB 86ms
82ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_444774974.img.png/1725494192518/fig39-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b66a76be051ae670f5c2786172af1a704f1ecdb15aea3c3402fb42b9e5470598

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "127f9-62153ec604c00"
Age: 1284577
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 29Gh2wouh4ImSiHOnlzVo-JQqGpLBb57nZirdAX6b1QaSjJEmsXu2A==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:56:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 75769
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig40-geoserver-config-data.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1528863320.img.png/1725494220090/ 127 KB
128 KB 84ms
82ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1528863320.img.png/1725494220090/fig40-geoserver-config-data.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ec58ceb768e02c31b87f084fbe10f719b0c42d29c98fcca298688768c6f899e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1fbf5-62153ee0b8b00"
Age: 1283698
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: P312O4oXoisS4MZXyv9yLsOzkywVDg9yUg0SvHXOlAUGFD1RPCFzGA==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 130037
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig41-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_198093276.img.png/1725494235796/ 53 KB
55 KB 77ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_198093276.img.png/1725494235796/fig41-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

7fc88a2ccff93251684fc0526a1ef83f6b65bccc949e449d86f4df1bf945da94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "d499-62153eef06cc0"
Age: 1283699
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: DJFcr-dAFbMi2rixkLXnPHanrSzCfnAWTja24rI8kbFlVnBx8Qr2_A==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:15 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 54425
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig42-geoserver-fraudulent-site.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_280569393.img.png/1725494252217/ 64 KB
66 KB 81ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_280569393.img.png/1725494252217/fig42-geoserver-fraudulent-site.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

a036dd51b9d09070b4cb8eaa91c1a5abac51f7027e9741c79343a35411be739c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "100f5-62153eff3d300"
Age: 1283698
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 7uYg1_6qg0f88Y_BlIBGX4yv1Vtxhy7_uDQKsRpk-jSHAha8xowfMA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 6e88e2758d60d31557bd6a2743570ed0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 65781
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig43-geoserver-script-file-cron.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_212093578.img.png/1725494289081/ 35 KB
36 KB 77ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_212093578.img.png/1725494289081/fig43-geoserver-script-file-cron.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8a84bc1c645bc2d9b6e41e4e8b4582c2dbd3569b51df5ecedc989410e6be8fe7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "8ba4-62153f2286640"
Age: 1283699
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: NxpYz73Llf7ntqhBTOX-xrijarI02vsKruH1eIjGqtAOBJOZw40k_Q==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 edbe37857ecef88edf038f3b8d7d9742.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35748
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig44-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1895558288.img.png/1725494284576/ 26 KB
27 KB 77ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1895558288.img.png/1725494284576/fig44-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f8f726a217af8471c5c0e2c11fca16865b7dc42485185311fcbfa0603a4f7120

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6813-62153f1dc1b00"
Age: 1284575
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: r6ho2pwjMeKQlzUlm9NwMTxuhiXgUlqNl6jnYY9Ro2p1TUjaip6XGQ==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 54362c05a4ef085b95bdfe1b85c113d4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 26643
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig45-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_849748280.img.png/1725494304387/ 30 KB
31 KB 78ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_849748280.img.png/1725494304387/fig45-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

da9671920127171a9289888088dc3d9f3b62f2af8c3ac142f456faa1d49eccda

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "77a6-62153f30d4800"
Age: 1284576
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: k0g7mgK3GTR21w08xvE-bIXbxfmYzN4gjW7VK5yNcC3fiuA061bRfQ==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:24 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ae9942460bc2a5eb14623248b73a3c8a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 30630
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.10.0/ 356 KB
78 KB 110ms
33ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Bh9exWOPGIwRshWljrtlEw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735260901BC
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 50991
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:29 GMT
content-type: application/javascript
last-modified: Thu, 03 Dec 2020 02:43:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 196e3d49-701e-0078-0644-149a7b000000
cf-ray: 8c6215a47fd580ff-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 79698
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/ 99 KB
24 KB 82ms
35ms Fetch
application/x-javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: SDJFQYswktbx6w5cJzzMRQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF2B6F9C71
age: 44559
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 21 Sep 2024 13:15:29 GMT
date: Fri, 20 Sep 2024 13:15:29 GMT
content-type: application/x-javascript
last-modified: Thu, 28 Dec 2023 19:57:06 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-ms-request-id: 16a02b50-101e-0023-7a72-79a340000000
cf-ray: 8c6215a6bd5580d8-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24004
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 13 KB
4 KB 70ms
20ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: W9e0YobmEbvdB0V9OmpQkw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735209A34D6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 44987
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:29 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: e7ba9f8a-a01e-0009-5512-247c50000000
cf-ray: 8c6215a8382f80d8-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3329
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 45 KB
12 KB 69ms
16ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: zNsRoM1FEmsEgJoYMCNTng==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D897352245C4EA
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 47531
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:29 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:53 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 77f313b5-301e-0034-7eb4-210a4b000000
cf-ray: 8c6215a8383680d8-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11755
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 509 KB
121 KB 81ms
27ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cfbffc5a6b6598cb0bf93565da00397f881e0198bf2f24c8d963e4c7cfb45abf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "859a562c3003b9443ad4e70b3020dad9:1726790028.604703"
expires: Fri, 20 Sep 2024 14:15:30 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 123481
date: Fri, 20 Sep 2024 13:15:30 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:48 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 id Show response
dpm.demdex.net/ 368 B
917 B 39ms
5ms XHR
application/json 18.179.63.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1726838130524

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.179.63.210 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-179-63-210.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

845ab3eb76b8e1168bbcb722de86531cc914625c1d8cae783f1c35adbb704c4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-2-v062-0e21ed76e.edge-tyo3.demdex.com 3 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: jeVqoSxJTes=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.fortinet.com
content-length: 311
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:30 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 dest5.html
fortinet.demdex.net/ Frame 7D0A 0
0 285ms
0ms Document
text/html 54.92.33.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.92.33.217 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-92-33-217.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 20 Sep 2024 13:15:31 GMT
dcs: dcs-prod-tyo3-2-v062-0286ae2dd.edge-tyo3.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Mon, 19 Aug 2024 12:40:08 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: Dr4Mxr6YTHk=

GET
H2

200

ibs:dpid=411&dpuuid=Zu11cwAAAKK_QQN1
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=41693660238315688000305167721532418661
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11cwAAAKK_QQN1

42 B
715 B

83ms
24ms

Image
image/gif

18.179.63.210
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11cwAAAKK_QQN1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Server

18.179.63.210 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-179-63-210.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-1-v062-08dcf0c68.edge-tyo3.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: 26ac/czgR4M=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11cwAAAKK_QQN1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Fri, 20 Sep 2024 13:15:31 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

POST
H2 200 delivery Show response
fortinet.tt.omtrdc.net/rest/v1/ 351 B
840 B 332ms
36ms XHR
application/json 63.140.50.191
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.tt.omtrdc.net/rest/v1/delivery?client=fortinet&sessionId=76ffc8b03eea4dfda0815feac1fcbea9&version=2.10.0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.50.191 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

fc872fc9e36aa5933777799794400cddfb9be6bb1643cd6e4b154e280c694dfa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: e43c4298-380e-4de5-acbe-add674bd8a19
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://www.fortinet.com
date: Fri, 20 Sep 2024 13:15:30 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 35 KB
13 KB 124ms
55ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "d8232f86c8016a8e0acaa7ecfdf72b3e:1722493571.189276"
expires: Fri, 20 Sep 2024 14:15:30 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 13012
date: Fri, 20 Sep 2024 13:15:30 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 3 KB
2 KB 124ms
55ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "bb4b6453e3ab80111a2b227318d22efb:1722493571.614634"
expires: Fri, 20 Sep 2024 14:15:30 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1597
date: Fri, 20 Sep 2024 13:15:30 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 0786.js Show response
script.crazyegg.com/pages/scripts/0117/ 7 KB
3 KB 126ms
38ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8db92e7cdc1ad40168c42e93b05d842e056d8a5b83ae96b95d2b1c546f828196

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1078
cf-polished: origSize=6998
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: text/javascript
last-modified: Fri, 20 Sep 2024 12:57:33 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c6215aef9b2f6f6-NRT
access-control-allow-origin: *
ce-version: 11.5.282
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 354ms
45ms Script
application/javascript 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2ac314870072e1aad5c1c2c1ebb9ba542bf1a9df18963c2c4f1d8fcab8711bde

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66e78018-111cd"
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 16:15:31 GMT
accept-ranges: bytes
content-length: 18822
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Mon, 16 Sep 2024 00:47:20 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 28 KB
9 KB 301ms
32ms Script
application/x-javascript 23.207.173.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.207.173.158 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-207-173-158.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8489534bde4ad3c3cedebecd11b9babe653de6b413922ec2b877c5bfcb33ee3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Content-Encoding: gzip
ETag: "7437febf15b08e005ac33eb9fc2707ae:1721634584.416148"
Connection: keep-alive
Expires: Fri, 20 Sep 2024 13:35:31 GMT
Accept-Ranges: bytes
X-CC: JP
Content-Length: 8614
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:31 GMT
Content-Type: application/x-javascript
Last-Modified: Mon, 22 Jul 2024 07:46:05 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 25f2dd15-02c6-4e7a-bc8b-c5722b49624d Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 359ms
94ms Script
application/javascript 34.87.122.136
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.87.122.136 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 136.122.87.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-request-id: F_b2IacKFJnMiPqomMRB
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
15 KB 162ms
23ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "803483b3aaadb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 704668F5C82D46AC9F55734AF58E5973 Ref B: TYO201100116027 Ref C: 2024-09-20T13:15:31Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14402
date: Fri, 20 Sep 2024 13:15:30 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 15:43:41 GMT
vary: Accept-Encoding

GET
H2 200 RCac955f2e1e97429197e1e31aaec22e86-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1 KB
942 B 90ms
14ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCac955f2e1e97429197e1e31aaec22e86-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f90b5ef7baa9dfccda582eb0ec80a2e2848cd5b3edc866629cda33cf4ff6df48

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:31 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 685
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 9 KB
2 KB 90ms
15ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 10fc9a12b905f9f21665f11fa5b183eae31166f74fce090bf179eb4c823b5ecc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:31 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1846
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 358 B
485 B 91ms
15ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2589fe281a342d19f8ddcd924727496b916202c4e42edb2553f25074746db938

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:31 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 229
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 703 B
684 B 86ms
13ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 15c2c29198d9315260cc26261e96a036d215fa28a46836302a576392e0e20ecd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:31 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 427
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 360 KB
118 KB 234ms
90ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

36cc787b21a3e954008891b38b0a2694aa889c43287923aa39d4d1843214d09a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:31 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120798
date: Fri, 20 Sep 2024 13:15:31 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 RC06cd6a06a307489f80febc787462cb12-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 635 B
642 B 82ms
12ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC06cd6a06a307489f80febc787462cb12-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 320f37b3eca2011055c9ab5a10b5de0f57a22fd740e504fe7e02c9898041abbb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:31 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 385
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/site/ 10 KB
2 KB 105ms
79ms XHR
application/json 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f313c8c3aaec2c1b82bdf04b99d12b5b456dd6e4ccb2957e7a584c42683eba5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 31
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/json
last-modified: Fri, 20 Sep 2024 12:57:33 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c6215b04d88d4bf-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1782
ce-version: 11.5.282
server: cloudflare

GET
H3 200 db7349b994413162218df5c920535415.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 103 KB
35 KB 52ms
38ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df9f1f8f4deeec8193dbcf3074a9e4767db05cc6c3b4dca6a9cafff884fb0816

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1085
cf-ray: 8c6215b21e93f6f6-NRT
cf-polished: origSize=105321
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: text/javascript
last-modified: Fri, 06 Sep 2024 19:46:55 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK unifiedPixel Show response
tr.outbrain.com/ 53 B
321 B 402ms
129ms Fetch
image/gif 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?au=false&bust=004018496200107724&referrer=&cht=ot&marketerId=00ad3119690e692fd6990245f9741ea8f1&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&g=0&obApiVersion=1.1&obtpVersion=2.0.5

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

38.133.127.191 Sacramento, United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 54
content-encoding: br
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: image/gif;
x-traceid: 17fe5a0c940247e410453abf3685773a

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 397ms
131ms Script
application/javascript 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

38.133.127.191 Sacramento, United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 39
content-encoding: br
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/javascript
x-traceid: 8377edf1a889fd549ddab6812b48799f

GET
H/1.1 200
OK 00ad3119690e692fd6990245f9741ea8f1 Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
516 B 74ms
24ms Script
text/html 23.207.173.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.207.173.158 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-207-173-158.deploy.static.akamaitechnologies.com

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
Cache-Control: max-age=60
ob-sent-time: 1726821107559
Content-Encoding: gzip
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Expires: Fri, 20 Sep 2024 13:16:31 GMT
Access-Control-Allow-Origin: *
X-CC: JP
Content-Length: 22
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:31 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
x-traceid: 63b794c791c786e18da33e49c2470af7

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 67ms
12ms Fetch
text/html 23.207.173.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.207.173.158 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-207-173-158.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Connection: keep-alive
Observe-Browsing-Topics: ?1
Expires: Fri, 20 Sep 2024 13:35:31 GMT
Access-Control-Allow-Origin: *
X-CC: JP
Content-Length: 26
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:31 GMT
Content-Type: text/html

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 47ms
3ms XHR
text/html 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-118-161.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.fortinet.com
content-length: 7
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 18 B
304 B 72ms
16ms XHR
text/html 2600:140b:1c00:39::1732:7614
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:1c00:39::1732:7614 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: e72fc9693b94bd6f4cea4fa172adc70989eca7c72cbdcb48f51ceaa7063ab230

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:ac8:40:1e::2e
expires: Fri, 20 Sep 2024 13:15:31 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1726838131547_388834580_450931_28_879_1_8_219";dur=1
access-control-allow-origin: https://www.fortinet.com
content-length: 18
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 210ms
180ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A31%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:31 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 190ms
162ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%225eeecf22b2d12a77a14639dce97b7a36%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227381d1d7c753fe2d8e217c3fdc44c0f17418dcc4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:32 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 17532650.js Show response
bat.bing.com/p/action/ 370 B
435 B 58ms
29ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17532650.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

cee682bc57d94c16933b0422aa0bd7ad8c7a6e04643eb7ce170e2d5ce6e25b48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C936331EA94D454084033FE7455FD976 Ref B: TYO201100116027 Ref C: 2024-09-20T13:15:31Z
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:30 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 186ms
141ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A40%3A1e%3A%3A2e%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:32 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
103 KB 139ms
103ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

940cc004817de61385850acf62a3ef522796f8f13b86842f7d2439f1149a81b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:31 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104907
date: Fri, 20 Sep 2024 13:15:31 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 744 B
718 B 122ms
29ms XHR
application/json 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: 904ada5a93d55f8c5412c4472a62bfbc46e215422ebdea166d95ed3434d97d4f

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-encoding: gzip
x-6si-region: ap-northeast-1a
access-control-allow-credentials: true
x-trace-id: 1651748516537907021
access-control-allow-origin: https://www.fortinet.com
content-length: 395
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: nginx

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 68ms
0ms Preflight 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Fri, 20 Sep 2024 13:15:31 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: ap-northeast-1a
x-trace-id: 1736842863487438799

GET
H2 204 0
bat.bing.com/action/ 0
361 B 54ms
39ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=a9dbd0d4-1ffe-4e11-91d4-719f459eda7a&sid=69bed6f0775211efaa4be963648c7238&vid=69bf6900775211efa35c3391c83902dd&vids=1&msclkid=N&pi=918639831&lg=ja-JP&sw=1600&sh=1200&sc=24&tl=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&kw=FortiGuard%20Labs%20Threat%20Research,Cara%20Lin&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&r=&lt=3272&pt=1726838125505,,,,,203,206,208,209,994,703,995,1072,1138,1213,3140,3140,3272,,,&pn=0,0&evt=pageLoad&sv=1&cdb=AQET&rn=182888

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CA55FDA9F6DB4C2A92371C9CF42BBC32 Ref B: TYO201100116027 Ref C: 2024-09-20T13:15:31Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:30 GMT

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/sampling/ 46 B
257 B 51ms
44ms XHR
application/json 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/sampling/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ef0e68967411e0314dcc9b45416c54100ebf112f0fc6dc08cc3e1f1f9fa0436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 30
date: Fri, 20 Sep 2024 13:15:31 GMT
content-type: application/json
last-modified: Fri, 20 Sep 2024 12:57:35 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c6215b4ac09d4bf-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 65
ce-version: 11.5.282
server: cloudflare

GET
H2 200 clock Show response
tracking.crazyegg.com/ 40 B
147 B 214ms
67ms XHR
text/plain 43.202.117.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?t=1&tk=329ee1373036c5ddcda74cf257baa0a6&u=1170786&s=424000&p=%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v=2f9599eefdac8a6ec5ee8cb4d77734c991d7c416&f=fortinet.com%2Fblog%2Fthreat-research%2F*&ul=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.202.117.154 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-202-117-154.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: bffa4af378368e7e6bbf1bc1bfb72b986f4a4c19671abf63de7b403e2a62bdcc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store
access-control-allow-origin: *
content-length: 40
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: text/plain
server: awselb/2.0

GET 19027954-8fbb-420c-8986-346cfdb4b499
https://www.fortinet.com/ Frame 0
0

GET
H2 200 s21386295605221
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/ 43 B
388 B 94ms
8ms Image
image/gif 63.140.50.191
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/s21386295605221?AQB=1&ndh=1&pf=1&t=20%2F8%2F2024%2022%3A15%3A32%205%20-540&sdid=3450840DF98BA247-5BB0C3863D498DD5&mid=41328116926074306960340600619888331757&aamlh=11&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Athreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&c7=Entire%20Site&c8=New&v25=41328116926074306960340600619888331757&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Athreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v106=Voluntari&v107=Ilfov&v108=Romania&v126=NA&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.50.191 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

etag: 3708356652400672768-4618262265212478339
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:15:32 GMT
p3p: CP="This is not a P3P policy"
date: Fri, 20 Sep 2024 13:15:32 GMT
last-modified: Sat, 21 Sep 2024 13:15:32 GMT
vary: *
x-adobe-ingress: hp
content-type: image/gif;charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
pragma: no-cache
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block
server: jag

GET
H3 200 ca6be1649b2c6bd5aa79ebaa229fa676.js Show response
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ 20 KB
8 KB 53ms
50ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ca6be1649b2c6bd5aa79ebaa229fa676.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7701282ea59743a1d336ee5ede4e6805ca9572c28ad013fa956fb39f18de0d69

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1085
cf-ray: 8c6215b6de3cf6f6-NRT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: text/javascript
last-modified: Wed, 18 Sep 2024 13:30:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 9ca7c9e85a6ce51bd9b80280f971319a.js Show response
script.crazyegg.com/pages/versioned/tracking-scripts/ 95 KB
31 KB 45ms
43ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/tracking-scripts/9ca7c9e85a6ce51bd9b80280f971319a.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: daaa79b81fa49a10852df79446783b9c51de167ee31aaff722e030c6cacc674b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1088
cf-ray: 8c6215b75f0cf6f6-NRT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: text/javascript
last-modified: Mon, 16 Sep 2024 20:30:38 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 251 KB
88 KB 156ms
89ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

66a4281a7684239d0eaeb9e42ad71f249a5a452e286acdb9f99040797ff6fb15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 90477
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 155ms
90ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d4605d3f38a876e45340bcdbdba4553a7eeba8708fb4ae1db1c893a2248f4580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79027
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 231 KB
83 KB 228ms
164ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4e087b4fdf2d01e82e172c013dadf27dd879737dd595df92fa435f4662538d51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 85155
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
86 KB 224ms
164ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f4eef873faaecfdeedc996d3f32d0c4d6775a01d0069afe29eb08e0080159899

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 88087
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 360 KB
118 KB 224ms
164ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c606f50ac3bdb01ca0e7959384ecd7d9cdf670a23594c9b5f945bd7ec8422c9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:32 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120884
date: Fri, 20 Sep 2024 13:15:32 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 51 KB
18 KB 127ms
6ms Script
application/javascript 2400:52e0:1501::1193:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1501::1193:1 , Japan, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-JP1-1193 /
Resource Hash: ab5b000d7c8c84f2cc6dbaacd88498126fa4b2fcb04cf14ae9fcd8eef9623760

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"66e2dd78-cca5"
cdn-fileserver: 869
date: Fri, 20 Sep 2024 13:15:32 GMT
cdn-storageserver: JP-394
last-modified: Thu, 12 Sep 2024 12:24:24 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 09/19/2024 20:09:41
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 10d1c044599fcf3691c4ded82576cf99
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 1184
server: BunnyCDN-JP1-1193
cdn-requestcountrycode: JP

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 143ms
34ms Fetch
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-38BQ9XFDT4&gtm=45je49j0v9191763579za200&_p=1726838130956&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=1671318838.1726838133&ul=ja-jp&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726838132&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&dt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=7066
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 305ms
288ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A32%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A31%20GMT%22%2C%22timeSpent%22%3A%221065%22%2C%22totalTimeSpent%22%3A%221065%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:32 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:32 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 201 v11 Show response
tracking.crazyegg.com/ 0
82 B 124ms
75ms XHR
text/plain 43.202.117.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.202.117.154 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-202-117-154.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/gzip
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:33 GMT
content-type: text/plain
server: awselb/2.0

OPTIONS
H2 204 v11
tracking.crazyegg.com/ Frame 0
0 103ms
49ms Preflight 43.202.117.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.202.117.154 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-202-117-154.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public, max-age=86400
date: Fri, 20 Sep 2024 13:15:32 GMT
server: awselb/2.0
vary: Access-Control-Request-Headers, Origin, Access-Control-Request-Method

GET
H2 200 api.min.css
a.omappapi.com/app/js/ 10 KB
3 KB 123ms
11ms Stylesheet
text/css 2400:52e0:1501::1193:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1501::1193:1 , Japan, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-JP1-1193 /
Resource Hash: 71e3c0057bec6dab5d49a1b6994c8e4fffa97614ba115bc8747a2be7c43ed048

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"66e2dd79-2644"
cdn-fileserver: 681
date: Fri, 20 Sep 2024 13:15:33 GMT
cdn-storageserver: JP-394
last-modified: Thu, 12 Sep 2024 12:24:25 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 09/19/2024 20:09:41
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 5e3a69833b6c97162880d2e5d0367eba
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 1185
server: BunnyCDN-JP1-1193
cdn-requestcountrycode: JP

GET
H2 401 39852 Show response
api.omappapi.com/v2/embed/ 165 B
593 B 331ms
208ms XHR
application/json 2606:4700:3108::ac42:2af8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2af8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-user-agent: standard--
cf-cache-status: DYNAMIC
expires: Fri, 20 Sep 2024 13:16:10 GMT
x-cache: Error from cloudfront
x-amz-cf-id: q0ty8k0UdCxUMayiGbQqRZYRnmZtmetQrPA_Yyrp59-S-C5J3DT9wA==
date: Fri, 20 Sep 2024 13:15:33 GMT
x-cache-config: 0 0
content-type: application/json
vary: Accept-Encoding, User-Agent
access-control-allow-headers: X-CSRF-Token
cache-control: public, max-age=120, stale-while-revalidate=1800
via: 1.1 1d52323084c6753f5a9a5a3fa0fda23c.cloudfront.net (CloudFront)
cf-ray: 8c6215bb6ab73481-NRT
access-control-allow-origin: *
content-length: 165
x-amz-cf-pop: NRT57-P3
server: cloudflare

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 186ms
58ms Script
text/javascript 2606:4700::6812:1247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1247 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 76861
via: 1.1 google
cf-ray: 8c6215bb7b72af64-NRT
expires: Fri, 20 Sep 2024 13:35:33 GMT
date: Fri, 20 Sep 2024 13:15:33 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK tag.js Show response
abm-tracking.demandscience.com/ 2 KB
2 KB 531ms
195ms Script
application/javascript 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/tag.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: public, max-age=0
ETag: W/"82b-18f5d3a3d78"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2091
Date: Fri, 20 Sep 2024 13:15:33 GMT
Content-Type: application/javascript; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Thu, 09 May 2024 12:00:49 GMT

GET
H2 200 wid.tracker.js Show response
tmp.argusplatform.com/js/ 8 KB
3 KB 340ms
218ms Script
text/javascript 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://tmp.argusplatform.com/js/wid.tracker.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preloadmax-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preloadmax-age=31536000
cache-control: public, must-revalidate, max-age=30
x-dns-prefetch-control: off
content-encoding: br
etag: "28476869"
referrer-policy: same-origin
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:33 GMT
x-xss-protection: 1; mode=block
content-type: text/javascript
last-modified: Sat, 08 Jun 2024 11:51:22 GMT
vary: Accept-Encoding
x-azure-ref: 20240920T131533Z-r1677749c86pzr7lsg2n28qdcs000000026000000000tte2

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ 161 B
712 B 882ms
271ms Script
text/javascript 74.121.140.211
PAEDAE-INC

General

Check archive.org

Show headers Download Go to

Full URL

https://pixel.mathtag.com/event/js?mt_id=1629896&mt_adid=260855&mt_exem=&mt_excl=&v2=&v3=&s1=&s2=&s3=&v1=en:blog:threat-research:threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.121.140.211 Reston, United States, ASN30419 (PAEDAE-INC, US),

Reverse DNS

Software

MT3 1668 f41eadd master iad iad-pixel-x11 config_version:"2232" /

Resource Hash

98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457

Security Headers

Name	Value
Strict-Transport-Security	31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Strict-Transport-Security: 31536000
Cache-Control: no-cache
Content-Encoding: gzip
Connection: close
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Fri, 20 Sep 2024 13:15:33 GMT
X-XSS-Protection: 0
Content-Type: text/javascript
Server: MT3 1668 f41eadd master iad iad-pixel-x11 config_version:"2232"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 316 KB
105 KB 131ms
118ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

aacafc943455fbee6be8a0c9d1b058dda7c90464b9f4975dc50ef33e0b44eb07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:32 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 107081
date: Fri, 20 Sep 2024 13:15:32 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H/1.1 200
OK footer-links.json Show response
www.fortinet.com/content/dam/fortinet-blog/ 310 KB
36 KB 296ms
112ms XHR
application/json 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/footer-links.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "4d8dc-61d89b0f78340-gzip"
Age: 5511025
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ABwF7jp8dnyQC_XIOsOq74W-1LHuUr484InWH_9RHISw_k6CPqpAyw==
Date: Fri, 20 Sep 2024 01:13:59 GMT
Content-Type: application/json
Vary: Accept-Encoding
Last-Modified: Thu, 18 Jul 2024 18:24:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 894f321aaec7e16111835f5b53fa21a4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35378
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
442 B 339ms
214ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1726838133111&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
ibc_rate_tier: 1247773
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Fri, 20 Sep 2024 14:15:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Fri, 20 Sep 2024 13:15:33 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AD-8ljv6-vXK8pCBot7xSvDGGLzAAuBHr74gO18nmUBg7kcw5lx68dRivVdYWsF2KNHL4LrPkg8
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 221ms
169ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1726838133111&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 20 Sep 2024 13:15:33 GMT
expires: Fri, 20 Sep 2024 13:15:33 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AD-8ljtcQYeVMg1TFXYsSiCcLTg_X6eWEd7TzhBU2AqG6ytekcTq_rl_cIyqdZYVrsblsKt4tVs

GET
H2 200 activityi;fledge=1;src=10050195;npa=0;auiddc=1777323958.1726838133;ps=1;pcor=1919840651;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9191763579;gcd=...
td.doubleclick.net/td/fls/rul/ Frame BA60 0
0 275ms
36ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=1777323958.1726838133;ps=1;pcor=1919840651;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9191763579;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:33 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;src=10050195;npa=0;auiddc=1777323958.1726838133;ps=1;pcor=1919840651;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9191763579;gcd=13l3l3l3l1...
ad.doubleclick.net/ 42 B
65 B 412ms
243ms Image
image/gif 172.217.26.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;src=10050195;npa=0;auiddc=1777323958.1726838133;ps=1;pcor=1919840651;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9191763579;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.26.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bom05s09-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Fri, 20 Sep 2024 13:15:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET activity;register_conversion=1;src=10050195;npa=0;auiddc=1777323958.1726838133;ps=1;pcor=1919840651;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb919...
ad.doubleclick.net/ 0
0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 6 KB
2 KB 186ms
113ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1726838133467&cv=11&fst=1726838133467&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

bdda9c1c6a0c19bfa11d1c25d17879fb054d11446fa6b54a0bf7cc338acb8614

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2408
date: Fri, 20 Sep 2024 13:15:33 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 662878185
td.doubleclick.net/td/rul/ Frame DE0A 0
0 137ms
95ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/662878185?random=1726838133467&cv=11&fst=1726838133467&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:33 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 401 / Show response
pixels.argusplatform.com/wh/track/ 205 B
468 B 1071ms
915ms XHR
application/json 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838134452598664&event_type=page_request&timestamp=1726838134&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20240920T131533Z-r1677749c86fflnqhme7tbbvms0000000bwg000000017ahh

GET
H2 200 fp.min.js Show response
cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/ 33 KB
15 KB 173ms
28ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY"
age: 13697
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 20 Sep 2024 13:15:33 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220049-FRA, cache-tyo11947-TYO
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15023
x-jsd-version: 3.4.2

GET
H2 200 site-visitors Show response
intentstream.contanuity.com/api/ 115 B
374 B 151ms
131ms Fetch
application/json 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-pixel-auth: true
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=15724800; includeSubdomains
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 115
date: Fri, 20 Sep 2024 13:11:58 GMT
content-type: application/json; charset=utf-8
vary: origin
server: nginx

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 250ms
207ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A32%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%222068%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:33 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:33 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H2 200 site-visitors
intentstream.contanuity.com/api/ Frame 0
0 493ms
127ms Preflight 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-pixel-auth
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-pixel-auth
access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
content-length: 0
date: Fri, 20 Sep 2024 13:11:58 GMT
server: nginx
strict-transport-security: max-age=15724800; includeSubdomains

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 6 KB
2 KB 76ms
68ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1726838133721&cv=11&fst=1726838133721&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

448edbb969fa89cb34eee5b730ff672e2c2b1175ae9786b1ce8557f6bdc1bca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2405
date: Fri, 20 Sep 2024 13:15:33 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 609297413
td.doubleclick.net/td/rul/ Frame 2FBF 0
0 137ms
103ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/609297413?random=1726838133721&cv=11&fst=1726838133721&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:33 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/ 6 KB
2 KB 82ms
76ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/?random=1726838133818&cv=11&fst=1726838133818&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

accfade6542b43626934d1599a23d727ac194fc7dea3a9bb99856a58ea3a3366

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2421
date: Fri, 20 Sep 2024 13:15:33 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 729495989
td.doubleclick.net/td/rul/ Frame AA55 0
0 137ms
112ms Document
text/html 172.217.161.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/729495989?random=1726838133818&cv=11&fst=1726838133818&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.161.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s23-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:33 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
BLOB 200
OK 60adbe5d-d8c0-4246-af6f-b902d126983b
https://www.fortinet.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.fortinet.com/60adbe5d-d8c0-4246-af6f-b902d126983b
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H3 200 /
www.google.com/pagead/1p-user-list/662878185/ 42 B
64 B 156ms
49ms Image
image/gif 142.250.196.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/662878185/?random=1726838133467&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfrCzHp8tBCvGu4be_lBvjN0AAemFh-w&random=449828732&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.196.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s36-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/662878185/ 42 B
64 B 168ms
55ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/662878185/?random=1726838133467&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfrCzHp8tBCvGu4be_lBvjN0AAemFh-w&random=449828732&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
64 B 115ms
46ms Image
image/gif 142.250.196.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1726838133721&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnffeqdRuR6GcP3Envpfbg8SfA0WxEiI2yuOVLY65hspw-N21-j&random=3525928238&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.196.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s36-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/609297413/ 42 B
64 B 130ms
55ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/609297413/?random=1726838133721&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnffeqdRuR6GcP3Envpfbg8SfA0WxEiI2yuOVLY65hspw-N21-j&random=3525928238&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/729495989/ 42 B
64 B 59ms
56ms Image
image/gif 142.250.196.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/729495989/?random=1726838133818&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfslGsVjqYYiZyJQyMgfebtwHNMZ-KOSEuDA36wwSaSYWUlBAO&random=3286425528&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.196.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s36-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/729495989/ 42 B
64 B 67ms
64ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/729495989/?random=1726838133818&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9191763579&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1777323958.1726838133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfslGsVjqYYiZyJQyMgfebtwHNMZ-KOSEuDA36wwSaSYWUlBAO&random=3286425528&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 53ms
52ms Fetch
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-JH142QCQCJ&gtm=45je49j0v893708426za200zb9191763579&_p=1726838130956&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422&cid=1671318838.1726838133&ul=ja-jp&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726838134&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&dt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_ss=1&_ee=1&tfd=9031
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
1015 B 11ms
9ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: af89d0f65e1c53f2831c1b73f25ee3053fddc6551962dc58eada982a2fd99bdd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 758
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7be3d22b2fd6487ca9390477738587fe-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
756 B 14ms
11ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC7be3d22b2fd6487ca9390477738587fe-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 59d12a10e99345ccbe1776752be1dcab5d337248fb1f523fb3cf93ffecf3a779

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC407b573180554ea6b11eecdc31ecbd3f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
756 B 11ms
9ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC407b573180554ea6b11eecdc31ecbd3f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2d0ddcf9662d44f133470ee7c926c568e540874718195167d7ce2eae31839a2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC1d92f04752ae42a38e54de48cb85adf4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 661 B
648 B 13ms
12ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC1d92f04752ae42a38e54de48cb85adf4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4b1017ddd583b8790466a28987a1dabd2d750fcbc0dbffbf263bee2e4cd35791

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 391
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf940460311f349b5af69d075bdef61d4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 368 B
492 B 11ms
10ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCf940460311f349b5af69d075bdef61d4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 956915db9ed8f96ac4ee123a7909637e7db25f3ea20e41927c5fcc4fd50108ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 235
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 754 B
704 B 11ms
6ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a57c6cd6129a6ae679af72011e4529d2c322ff41ca4933dedd76150ffcae369

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 447
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
971 B 20ms
14ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 73ade03dfeae221bb318514f70aa5ae9c9c653b6871008ef9a3596f9255a78f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 714
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1021 B
857 B 18ms
14ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ee555b56d11e10b0a60e50d84be13221d318b328d16a7b59d77bb5dc7007e4d2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 601
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcd84e40d19c24776bef77836ab2f8df6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
758 B 17ms
13ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 7a520fb2812687266f06520e650deb9dece37e49629623c4be612b1f561e11df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 502
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 388 B
498 B 17ms
14ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8dbdd526d3da8b4924bc169cb3faee88cda6da11742ef935ae2e916a17b7d978

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 242
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5c60a51709a94068afbf065e1448b617-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 664 B
657 B 17ms
14ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC5c60a51709a94068afbf065e1448b617-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 88a5f8b5bcd4b32ed398b199bfc0ecf20ba41bf544d2ca04bc40111db7c66ab3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 401
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7675832323134b109ff7c59296e2d2ca-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1 KB
797 B 17ms
15ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC7675832323134b109ff7c59296e2d2ca-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d04f03c209c8b79223d1147dec2771c3e87a401dc1348b7dd10de0aa7d22297f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 540
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
981 B 18ms
16ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8109fbd42099eef3aed0564d81e4502bade4a64b6bd5174894f0f1e8019cd421

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 724
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 966 B
809 B 19ms
16ms Script
application/x-javascript 2600:140b:a00:396::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:396::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bb50d0022dac04a6c6a2fc5edf927a4682c8e6b73a970546c75ff118f06ad4e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:34 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 552
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 p Show response
i.simpli.fi/ 798 B
762 B 98ms
81ms Script
application/javascript 34.87.122.136
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp
Requested by: Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.87.122.136 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 136.122.87.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: cb0975f12465da215a90dd685d2e0cb99df5744093d4bef65edeec2cced59942

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: openresty

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 182 KB
66 KB 103ms
99ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4NSPPXN

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

76ec385cfb426fdef7dcfb25cf6819385aa1f5bc5bc8ca74ef39d2f0a842fb09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 67108
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 184ms
181ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A33%20GMT%22%2C%22timeSpent%22%3A%221023%22%2C%22totalTimeSpent%22%3A%223091%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:34 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK spx Show response
dx.mountain.com/ 23 KB
6 KB 793ms
139ms Script
application/javascript 52.88.179.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=7959104353123880term=value
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.88.179.26 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-88-179-26.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: d4ce12f625ecbb5284bc635a7f6c96c4bfd99511761efe7ddadcf8d1c29f9d79

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 2
connection: close
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: application/javascript;charset=utf-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: istio-envoy

GET
H/1.1 200
OK favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/ 318 B
2 KB 154ms
143ms Other
image/vnd.microsoft.icon 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "13e-565c628eb6a00-gzip"
Age: 6105669
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: LE6Z4j5fbiz0D2m6QHLv-yNGB7hs20_JGAUdsdAfhXd7KEVAFbr-4w==
Date: Fri, 20 Sep 2024 13:15:06 GMT
Content-Type: image/vnd.microsoft.icon
Last-Modified: Thu, 22 Feb 2018 05:17:28 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 69ce12cd28f192f5e142ba57e5fe0b80.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 133
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 51ms
8ms Script
application/javascript 151.101.228.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.228.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Fri, 20 Sep 2024 13:15:34 GMT
x-tw-cdn: FT
last-modified: Wed, 27 Mar 2024 23:09:36 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kiad7000135-IAD, cache-hnd18751-HND
x-amz-server-side-encryption: AES256

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1773420&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

43 B
1 KB

137ms
94ms

Image
image/gif

103.43.90.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Protocol

Server

103.43.90.19 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.201.218; 146.70.201.218; 595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: e4a425bd-034e-4d16-bbd5-2da95d1c74bb
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:35 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 146.70.201.218; 146.70.201.218; 595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: e4f14886-5f24-40ba-89dd-9cc80326c71f
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:35 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?add=36113683
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

43 B
1 KB

206ms
129ms

Image
image/gif

103.43.89.4
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Protocol

Server

103.43.89.4 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.201.218; 146.70.201.218; 839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: e6a534f2-f9e8-4f05-bc29-e4b1ee9e657b
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:35 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.201.218; 146.70.201.218; 839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 10c163b7-6afd-4839-8d05-f6e13900b4d1
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:35 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 iztag.js Show response
tags.inzynk.io/0ulh3gex/ 34 B
443 B 50ms
9ms Script
application/octet-stream 2600:9000:2751:3600:12:dfa9:e200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.inzynk.io/0ulh3gex/iztag.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2751:3600:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding
x-amz-version-id: 15XT7F8rursoJ6jHrhKIXrYdXTZkWasY
etag: "595f7fa79bc22a7029d2751228622eb4"
age: 57810
via: 1.1 36cf18acfba4fa4f3949b71621f2b1e8.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 34
x-amz-cf-id: CfAv7DHagGOBvmLcV5aChDEOBiC8oSjLwYYwXY6eiG7HPvzUzpRk4g==
date: Thu, 19 Sep 2024 21:12:21 GMT
content-type: application/octet-stream
last-modified: Thu, 05 Sep 2024 13:11:02 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P2
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Show response
abm-tracking.demandscience.com/page-tracking/fortinet_2712/ 2 B
665 B 198ms
130ms Script
application/json 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/page-tracking/fortinet_2712/https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?visitorId=d13d32f58501fd8aea71a13fdffce4b8_1726838134717&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 20 Sep 2024 13:15:34 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 200 adsct
t.co/i/ 43 B
630 B 519ms
154ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=295fa21f-5bb1-4db8-83ea-eb75d89df821&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=813f80fc-26d5-4dcd-9cb4-6d719be78e65&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 265e35f78fe5cabf
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 4c747395ffeb68bfb5daae34cb392b3af7d2b9cd2a499a79b6c3a9ea0c623b7f
cf-cache-status: DYNAMIC
cf-ray: 8c6215c87b14d53e-NRT
x-response-time: 97
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 521ms
120ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=295fa21f-5bb1-4db8-83ea-eb75d89df821&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=813f80fc-26d5-4dcd-9cb4-6d719be78e65&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: fdcea2042bbe2b83
cache-control: no-cache, no-store, max-age=0
x-connection-hash: b2795a92a65d4b8498ccc90fd07dfaafff4b1814627a90bd95898bd3680e5d8f
x-response-time: 98
content-length: 43
date: Fri, 20 Sep 2024 13:15:34 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H2 200 adsct
t.co/i/ 43 B
470 B 518ms
154ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=3bfe4a97-62b2-4249-810c-b1c1f0eb9f3b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=813f80fc-26d5-4dcd-9cb4-6d719be78e65&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 2cd77f76de89885b
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 0827d2af4ce1780cbf114153b930c084645368c7c0443ab91cdbd8c657efca89
cf-cache-status: DYNAMIC
cf-ray: 8c6215c87b18d53e-NRT
x-response-time: 98
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
234 B 521ms
120ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=3bfe4a97-62b2-4249-810c-b1c1f0eb9f3b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=813f80fc-26d5-4dcd-9cb4-6d719be78e65&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: d18795cc38dd04fe
cache-control: no-cache, no-store, max-age=0
x-connection-hash: b2795a92a65d4b8498ccc90fd07dfaafff4b1814627a90bd95898bd3680e5d8f
x-response-time: 98
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H2

200

threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1963360059513.315
10104846.fls.doubleclick.net/activityi;dc_pre=CKy5hK3N0YgDFZdZDwIdl24lgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/ Frame C5A1
Redirect Chain

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;d...
https://10104846.fls.doubleclick.net/activityi;dc_pre=CKy5hK3N0YgDFZdZDwIdl24lgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoser...

0
0

72ms
54ms

Document
text/html

172.217.26.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10104846.fls.doubleclick.net/activityi;dc_pre=CKy5hK3N0YgDFZdZDwIdl24lgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1963360059513.315?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.26.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bom05s09-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 2243
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:35 GMT
expires: Fri, 20 Sep 2024 13:15:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:35 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10104846.fls.doubleclick.net/activityi;dc_pre=CKy5hK3N0YgDFZdZDwIdl24lgw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1963360059513.315?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
58 KB 356ms
6ms Script
application/x-javascript 157.240.31.5
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.31.5 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-nrt1.fbcdn.net

Software

Resource Hash

0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=16, rtx=0, c=23, mss=1232, tbw=4633, tp=13, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: LfPZtZxi9KWHKzW/bImhY4ySEyc4juE2eJHQ9rwz8k1giqM3TPsvQ86OgNqAX4OrLfeO+NTtHtuWwoqS3Y4Upw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 58953
x-xss-protection: 0

GET
H3 200 siteanalyze_6033413.js Show response
siteimproveanalytics.com/js/ 38 KB
12 KB 366ms
17ms Script
application/javascript 172.67.163.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6033413.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.163.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "8451e15415563cef4e816d6dd250d58a"
age: 842
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NO8ZBJqbaOrCdS6wZaAXtd%2BrpPXUgKtux0keQ7iI251tmmU8ZXxvU0S4Z4CRI8N5sIeJqA8A%2BfKBr%2FxeIbGLbcpEmOlHro6ZMGV3xAOu1YBXCpqvk7K%2BIIC3bYhRyrAJI6Ogtjzh6LG82jU%3D"}],"group":"cf-nel","max_age":604800}
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 03 Sep 2024 18:55:37 GMT
vary: Accept-Encoding
x-amz-id-2: Yv94dhn3w2VACa/DnZ6nXYTZst7VioytpbXHh5oDCTBck65RihSnCigFjAnsYSAHaoTYPKSD4VjxyDEJIDy5h7icd1AhOEx/
cache-control: max-age=86400, no-transform
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 1YFZAMW0V72Z36H0
cf-ray: 8c6215c8bdc580fb-NRT
accept-ranges: bytes
content-length: 11550
server: cloudflare

GET
H2 200 adsct
t.co/i/ 43 B
465 B 354ms
156ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=928a79f6-5230-43a1-b983-438a66199852&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=813f80fc-26d5-4dcd-9cb4-6d719be78e65&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 8385e049ee754d29
cache-control: no-cache, no-store, max-age=0
x-connection-hash: cffb6bdab964fc676e55e6a3a2c009580edb348ca01f76c56494ea123cbd340e
cf-cache-status: DYNAMIC
cf-ray: 8c6215c87b19d53e-NRT
x-response-time: 98
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
214 B 137ms
125ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=928a79f6-5230-43a1-b983-438a66199852&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=813f80fc-26d5-4dcd-9cb4-6d719be78e65&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: ad3dd9d85c2d1958
cache-control: no-cache, no-store, max-age=0
x-connection-hash: b2795a92a65d4b8498ccc90fd07dfaafff4b1814627a90bd95898bd3680e5d8f
x-response-time: 97
content-length: 43
date: Fri, 20 Sep 2024 13:15:34 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=98F335567E784DE4B818938C71A8A5CC
https://rtb-csync.smartadserver.com/redir/?partnerid=133&partneruserid=6499164f1c&gdpr=0&gdpr_consent=

43 B
659 B

254ms
81ms

Image
image/gif

23.106.127.56
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=133&partneruserid=6499164f1c&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 23.106.127.56 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD., SG),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 20 Sep 2024 13:15:35 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb-csync.smartadserver.com/redir/?partnerid=133&partneruserid=6499164f1c&gdpr=0&gdpr_consent=
via: 1.1 38ea5a230f3505e8dd398e8fb7e88abc.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: yksnYGtnFYdtlp1zXkC8xwd6a3dxM6W-VoZzcUbg8gnoWkdBSS4CLw==
date: Fri, 20 Sep 2024 13:15:35 GMT
x-amz-cf-pop: NRT20-P3
server: CloudFront

GET
H2

200

RX-eeb83afc-6957-463d-88ab-ad072def41b0-004
sync.targeting.unrulymedia.com/csync/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/98F335567E784DE4B818938C71A8A5CC
https://sync.1rx.io/usersync/simplifi/98F335567E784DE4B818938C71A8A5CC?zcc=1&cb=1726838135695
https://sync.targeting.unrulymedia.com/csync/RX-eeb83afc-6957-463d-88ab-ad072def41b0-004

43 B
378 B

213ms
50ms

Image
image/gif

74.118.186.107
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-eeb83afc-6957-463d-88ab-ad072def41b0-004
Protocol: H2
Server: 74.118.186.107 Serangoon New Town, Singapore, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Fri, 20 Sep 2024 13:15:35 GMT
content-length: 43

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://sync.targeting.unrulymedia.com/csync/RX-eeb83afc-6957-463d-88ab-ad072def41b0-004
date: Fri, 20 Sep 2024 13:15:35 GMT
pragma: no-cache
content-type: text/html

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=98F335567E784DE4B818938C71A8A5CC&dongle=yf3
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=98F335567E784DE4B818938C71A8A5CC&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

37 B
474 B

104ms
95ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=98F335567E784DE4B818938C71A8A5CC&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: /xuid?ld=1&mid=7969&xuid=98F335567E784DE4B818938C71A8A5CC&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 20 Sep 2024 13:15:35 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=98F335567E784DE4B818938C71A8A5CC

43 B
175 B

579ms
167ms

Image
image/gif

2600:1f18:612b:4264:e3b7:dedd:c6b:bb7b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=98F335567E784DE4B818938C71A8A5CC
Protocol: H2
Server: 2600:1f18:612b:4264:e3b7:dedd:c6b:bb7b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Fri, 20 Sep 2024 13:15:36 GMT
content-type: image/gif
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://simplifi.partners.tremorhub.com/sync?UISF=98F335567E784DE4B818938C71A8A5CC
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:35 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=98F335567E784DE4B818938C71A8A5CC
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=98F335567E784DE4B818938C71A8A5CC

95 B
429 B

62ms
42ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=98F335567E784DE4B818938C71A8A5CC

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=98F335567E784DE4B818938C71A8A5CC
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Fri, 20 Sep 2024 13:15:35 GMT
server: Jetty(11.0.13)

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=98F335567E784DE4B818938C71A8A5CC
https://d.agkn.com/pixel/10751/?che=1726838135600&ip=146.70.201.218&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D231823305011003804166
https://um.simpli.fi/aa_px?sk=231823305011003804166
https://um.simpli.fi/empty.gif

43 B
361 B

89ms
80ms

Image
image/gif

34.142.175.23
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

34.142.175.23 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

23.175.142.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
location: /empty.gif
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=98F335567E784DE4B818938C71A8A5CC
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=98F335567E784DE4B818938C71A8A5CC&ckls=true&ci=RU1OFjWb2Q&nc=false&trid=1494116343

43 B
1 KB

193ms
186ms

Image
image/gif

3.164.110.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=98F335567E784DE4B818938C71A8A5CC&ckls=true&ci=RU1OFjWb2Q&nc=false&trid=1494116343
Protocol: H2
Server: 3.164.110.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-110-98.nrt12.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 a2a18b761c57d2eb35b02af9e68b39ec.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
x-amz-cf-pop: NRT12-P2
x-amz-cf-id: pkXoR9aQQtwz-ZoN6i9xTKnOF7kPa1A6cFnWcKVd84xQwJdQuOq1cA==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=98F335567E784DE4B818938C71A8A5CC&ckls=true&ci=RU1OFjWb2Q&nc=false&trid=1494116343
pragma: no-cache
via: 1.1 a2a18b761c57d2eb35b02af9e68b39ec.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
x-amz-cf-pop: NRT12-P2
x-amz-cf-id: lxlSIO8KSIf2Mehb63GyhI5HqkpwZ50yU0-HzIZNpvCpQLxdXJwV8Q==

GET
H2 200 pubmatic
um.simpli.fi/ 43 B
409 B 111ms
92ms Image
image/gif 34.142.175.23
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.142.175.23 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

23.175.142.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:35 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 freewheel
um.simpli.fi/ 43 B
409 B 111ms
93ms Image
image/gif 34.142.175.23
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/freewheel

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.142.175.23 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

23.175.142.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:35 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

engine
pbid.pro-market.net/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=98F335567E784DE4B818938C71A8A5CC;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=98F335567E784DE4B818938C71A8A5CC;mimetype=img;sr
https://cm.g.doubleclick.net/pixel?google_nid=datonics-ddp&google_cm&google_hm=LTkwMjkxMzA2NzQ0NTM0NjI0Nzg=
https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEOldn0wlwC08_nQOyafyfgQ&google_cver=1

43 B
388 B

176ms
155ms

Image
image/gif

2600:1901:0:8eee::
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEOldn0wlwC08_nQOyafyfgQ&google_cver=1
Protocol: H2
Server: 2600:1901:0:8eee:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
anserver: gapp2
expires: Mon, 1 Jan 1990 0:0:0 GMT
access-control-allow-origin: *
alt-svc: clear
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
server: Apache-Coyote/1.1

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEOldn0wlwC08_nQOyafyfgQ&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 315
date: Fri, 20 Sep 2024 13:15:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=98F335567E784DE4B818938C71A8A5CC&j=0
https://loadm.exelator.com/load/?p=204&g=2191&simid=98F335567E784DE4B818938C71A8A5CC&j=0&xl8blockcheck=1

0
2 KB

945ms
944ms

Image
text/plain

34.229.3.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=98F335567E784DE4B818938C71A8A5CC&j=0&xl8blockcheck=1
Protocol: H2
Server: 34.229.3.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-229-3-43.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 20 Sep 2024 13:15:37 GMT
x-powered-by: Undertow/1
server: nginx
access-control-allow-credentials: true

Redirect headers

cache-control: no-cache
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=98F335567E784DE4B818938C71A8A5CC&j=0&xl8blockcheck=1
access-control-allow-credentials: true
content-length: 0
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 20 Sep 2024 13:15:36 GMT
content-type: image/gif
x-powered-by: Undertow/1
server: nginx

GET
H2 200 yahoo
um.simpli.fi/ 43 B
409 B 112ms
94ms Image
image/gif 34.142.175.23
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/yahoo

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.142.175.23 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

23.175.142.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:35 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=98F335567E784DE4B818938C71A8A5CC

0
421 B

722ms
169ms

Image
text/plain

52.23.38.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=98F335567E784DE4B818938C71A8A5CC
Protocol: HTTP/1.1
Server: 52.23.38.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-23-38-239.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Date: Fri, 20 Sep 2024 13:15:35 GMT
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.bfmio.com/sync?pid=141&uid=98F335567E784DE4B818938C71A8A5CC
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:35 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=98F335567E784DE4B818938C71A8A5CC

62 B
445 B

231ms
155ms

Image
image/gif

23.2.37.89
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=98F335567E784DE4B818938C71A8A5CC
Protocol: H2
Server: 23.2.37.89 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-2-37-89.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
content-length: 62
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://stags.bluekai.com/site/29931?id=98F335567E784DE4B818938C71A8A5CC
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:35 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

tpid=98F335567E784DE4B818938C71A8A5CC
bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=98F335567E784DE4B818938C71A8A5CC
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=98F335567E784DE4B818938C71A8A5CC

49 B
264 B

128ms
119ms

Image
image/gif

18.138.15.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=98F335567E784DE4B818938C71A8A5CC
Protocol: H2
Server: 18.138.15.243 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-138-15-243.ap-southeast-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
x-server: 10.42.22.10
server: Jetty(9.4.38.v20210224)

Redirect headers

cache-control: no-cache
location: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=98F335567E784DE4B818938C71A8A5CC
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 20 Sep 2024 13:15:35 GMT
x-server: 10.42.7.36
server: Jetty(9.4.38.v20210224)

GET
H2

200

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=98F335567E784DE4B818938C71A8A5CC
https://ce.lijit.com/merge?pid=2&3pid=98F335567E784DE4B818938C71A8A5CC&dnr=1

43 B
511 B

158ms
123ms

Image
image/gif

54.71.108.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=98F335567E784DE4B818938C71A8A5CC&dnr=1
Protocol: H2
Server: 54.71.108.129 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-71-108-129.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 20 Sep 2024 13:15:36 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://ce.lijit.com/merge?pid=2&3pid=98F335567E784DE4B818938C71A8A5CC&dnr=1
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 20 Sep 2024 13:15:35 GMT
vary: Accept-Encoding

GET
H2

200

362358.gif
idsync.rlcdn.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=98F335567E784DE4B818938C71A8A5CC
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEAbJRGcW0vNDIy0iY23YcBk&google_cver=1

42 B
193 B

166ms
153ms

Image
image/gif

35.244.154.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEAbJRGcW0vNDIy0iY23YcBk&google_cver=1
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEAbJRGcW0vNDIy0iY23YcBk&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 289
date: Fri, 20 Sep 2024 13:15:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

/
www.google.co.jp/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1726838134651&cv=7&fst=1726838134651&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1563756270&cv=7&fst=1726838134651&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLH...
https://www.google.com/pagead/1p-conversion/1026675585/?random=1563756270&cv=7&fst=1726838134651&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHD...
https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=1563756270&cv=7&fst=1726838134651&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCL...

42 B
64 B

72ms
63ms

Image
image/gif

142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=1563756270&cv=7&fst=1726838134651&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCJvHsQI&pscrd=IhMIhO-Urc3RiAMVbpLpBR2SJho3MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfkKcNf_CPYSS5ejbJuiui1ycIteITS5YE1F4g-POZV0ydW7e0&random=1669458984&ipr=y

Protocol

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:35 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=1563756270&cv=7&fst=1726838134651&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCJvHsQI&pscrd=IhMIhO-Urc3RiAMVbpLpBR2SJho3MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfkKcNf_CPYSS5ejbJuiui1ycIteITS5YE1F4g-POZV0ydW7e0&random=1669458984&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:35 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 144ms
127ms Image
text/plain 34.142.175.23
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.142.175.23 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

23.175.142.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:35 GMT
x-content-type-options: nosniff

GET
H2

200

setuid
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=98F335567E784DE4B818938C71A8A5CC

43 B
1 KB

98ms
74ms

Image
image/gif

103.43.89.4
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=66&code=98F335567E784DE4B818938C71A8A5CC

Protocol

Server

103.43.89.4 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 146.70.201.218; 146.70.201.218; 839.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: c727dfef-0b16-4f98-bc99-548c633b44c6
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:35 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ib.adnxs.com/setuid?entity=66&code=98F335567E784DE4B818938C71A8A5CC
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:35 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=98F335567E784DE4B818938C71A8A5CC&expires=365

42 B
1 KB

319ms
86ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=98F335567E784DE4B818938C71A8A5CC&expires=365
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: da1c8a4a3f9301c03fbeb7a6212a0a54
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=98F335567E784DE4B818938C71A8A5CC&expires=365
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:35 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=98F335567E784DE4B818938C71A8A5CC

43 B
264 B

98ms
38ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072966&val=98F335567E784DE4B818938C71A8A5CC
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
vary: Accept
server: OXGW/0.0.0

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://us-u.openx.net/w/1.0/sd?id=537072966&val=98F335567E784DE4B818938C71A8A5CC
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:35 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_gid=CAESEAxr0A31rRkikbiPMIphVc4&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=98F335567E784DE4B818938C71A8A5CC
https://um.simpli.fi/g_match?id=

0
320 B

92ms
79ms

Image
text/plain

34.142.175.23
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=

Protocol

Server

34.142.175.23 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

23.175.142.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:15:35 GMT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:35 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

cache-control: no-cache, must-revalidate
location: https://um.simpli.fi/g_match?id=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 229
date: Fri, 20 Sep 2024 13:15:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

POST
H2 201 v11 Show response
tracking.crazyegg.com/ 0
82 B 101ms
91ms XHR
text/plain 43.202.117.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.202.117.154 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-202-117-154.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/gzip
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:34 GMT
content-type: text/plain
server: awselb/2.0

GET
H/1.1 200
OK tracking Show response
tracking.contanuity.com/ 2 B
769 B 418ms
118ms Script
application/json 54.203.236.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.contanuity.com/tracking?visitorId=d13d32f58501fd8aea71a13fdffce4b8_1726838134717&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.203.236.163 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-203-236-163.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 20 Sep 2024 13:15:35 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 401 / Show response
webtracker.argusplatform.com/wh/track/ 205 B
468 B 979ms
944ms XHR
application/json 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838134452598664&event_type=page_request&timestamp=1726838135&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:36 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20240920T131535Z-r1677749c864gnxwf415v7ms240000000170000000003mx6

GET
H3 200 177020962864941 Show response
connect.facebook.net/signals/config/ 66 KB
13 KB 39ms
36ms Script
application/x-javascript 157.240.31.5
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.167&r=stable&domain=www.fortinet.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.31.5 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-nrt1.fbcdn.net

Software

Resource Hash

6c96e2d7e3d052c2c4fc96b42a991077b82cc1118c272a97b8c2880a1ebd9357

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=74, mss=1232, tbw=67273, tp=66, tpl=0, uplat=2, ullat=-1
pragma: public
x-fb-debug: otLb2u21ERHfiRWAJFMsSKRdLe5Oy+3l0ZSRU4IMTexSO+fw9kqCbg0vUvSIwDHuQwlNZ1nXo4o77JYk9UGLew==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 13328
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 tag.aspx Show response
ml314.com/ 38 KB
39 KB 130ms
10ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?208
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
etag: "632616ff15825f030aab3391a58ef042"
age: 1159
x-goog-stored-content-encoding: identity
x-cache-hit: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39162
date: Fri, 20 Sep 2024 12:56:16 GMT
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
content-type: application/javascript
x-guploader-uploadid: AD-8ljuQiu-1cAO9rADqFGtO2OnagDkafKtmyYhep9day3MgRd7-Kxx8cbypXlfNcqGpPt8SG7Q
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
cache-id: NRT-33e460bb
accept-ranges: bytes
x-goog-generation: 1721849450340665
content-length: 39162
server: UploadServer

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 62ms
11ms Script
application/javascript 2600:140b:a00:e::b81d:8cdf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:140b:a00:e::b81d:8cdf Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=62001
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Fri, 20 Sep 2024 13:15:35 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 image.aspx
6033413.global.siteimproveanalytics.io/ 34 B
149 B 844ms
276ms Image
image/gif 13.48.36.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6033413.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&res=1600x1200&accountid=6033413&rt=9789&prev=6559f4e9-da87-2381-10ec-c3ec41bbe72a&luid=92aaaf2c-fd4f-4558-848e-b68eb39832e1&rnd=34737
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.48.36.94 Stockholm, Sweden, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-48-36-94.eu-north-1.compute.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: Fri, 20 Sep 2024 13:15:36 UTC
cache-control: max-age=0
content-length: 34
date: Fri, 20 Sep 2024 13:15:36 GMT
content-type: image/gif

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 40ms
5ms Image
text/plain 2a03:2880:f10f:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&rl=&if=false&ts=1726838135455&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726838135444.552701973432516314&ler=empty&cdl=API_unavailable&it=1726838135222&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f10f:83:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=10, mss=1368, tbw=2793, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 249ms
239ms Image
image/png 2a03:2880:f10f:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&rl=&if=false&ts=1726838135455&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726838135444.552701973432516314&ler=empty&cdl=API_unavailable&it=1726838135222&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f10f:83:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7416713316204886176"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x1df81ccff3911cb6","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"2":["24:1473595392721544","7830:1473595392721544","10853:1473595392721544","41:1473595392721544","8046:1473595392721544"]},"debug_reporting":true,"debug_key":"1950022727856819069"}
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: tWssd7OVoltoIP4QVPkb/nduti5EKXzHLfX+GHksakpMcx2kG/HUehRTtme7HbXYrKFwr6tCofJfCzy/TcooRg==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7416713316204886176", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=10, mss=1368, tbw=3145, tp=-1, tpl=-1, uplat=217, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H/1.1 200
OK is Show response
44.238.122.172/ 32 B
437 B 557ms
143ms Fetch
text/plain 44.238.122.172
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://44.238.122.172/is
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=7959104353123880term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 44.238.122.172 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-238-122-172.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 6ff3a6b13274ac400ff4d3d39177a0151495114c91cbb7c1330ce2b66a5bebd9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 1
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
content-length: 32
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: text/plain;charset=utf-8
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 198ms
190ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A34%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224092%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:35 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 utsync.ashx Show response
ml314.com/ 575 B
1 KB 52ms
47ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pv=1726838135706_sgpkhaw38&bl=ja-jp&cb=3053357&return=&ht=&d=&dc=&si=1726838135706_sgpkhaw38&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?208
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 9c8a46f991749e270426707815e60c7f21e00c72144b5aaa3cd9a313ecd710ca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: application/javascript
server: Google Frontend

GET
H2 200 ibs:dpid=22052&dpuuid=3647144422797738056&redir=
dpm.demdex.net/ 42 B
717 B 19ms
7ms Image
image/gif 18.179.63.210
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3647144422797738056&redir=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.179.63.210 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-179-63-210.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-1-v062-0ec253039.edge-tyo3.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: xJ5JqZoiSfI=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif

GET
H3

200

utsync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&gdpr=0&gdpr_consent=

43 B
61 B

66ms
64ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0,Sat, 21 Sep 2024 13:15:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

location: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&gdpr=0&gdpr_consent=
content-length: 241
date: Fri, 20 Sep 2024 13:15:35 GMT
server: Kestrel

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3647144422797738056
https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144422797738056

43 B
56 B

59ms
53ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144422797738056
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Sat, 21 Sep 2024 13:15:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-cache
location: https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144422797738056
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 20 Sep 2024 13:15:35 GMT
x-server: 10.42.2.152
server: Jetty(9.4.38.v20210224)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=24-vEWlYqGiG8W-kJ6bdu7DPZPRhnptwz_R4bJ9qBByY&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
https://ml314.com/csync.ashx?fp=24-vEWlYqGiG8W-kJ6bdu7DPZPRhnptwz_R4bJ9qBByY&person_id=3647144422797738056&eid=50052&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referre...
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

70 B
440 B

6ms
5ms

Image
image/gif

18.182.162.20
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Protocol: HTTP/1.1
Server: 18.182.162.20 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-182-162-20.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 20 Sep 2024 13:15:36 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
via: 1.1 google
expires: Sat, 21 Sep 2024 13:15:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Fri, 20 Sep 2024 13:15:36 GMT
content-type: image/gif
x-cloud-trace-context: f84ebe66fc244eecae04776a705a0d86
server: Google Frontend

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
762 B 206ms
173ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=7120%2C2159050%2C4628290&time=1726838135812&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.fortinet.com/

Response headers

x-li-pop: afd-prod-ltx1-x
content-encoding: gzip
x-fs-uuid: 0006228cd5ad177f376ac90ff3d846f1
x-msedge-ref: Ref A: BD078202BA5D4B0898BD2E8E60D8BC65 Ref B: TYAEDGE0809 Ref C: 2024-09-20T13:15:35Z
x-li-fabric: prod-ltx1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYijNWtF383askP89hG8Q==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:35 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838135812&li_adsId=caed7681-708e-48fb-a5ba-6138ac1612a3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-resea...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838135812&li_adsId=caed7681-708e-48fb-a5ba-6138ac1612a3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-rese...

0
487 B

174ms
159ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838135812&li_adsId=caed7681-708e-48fb-a5ba-6138ac1612a3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&e_ipv6=AQJKQ5349KwTjwAAAZIPkty4nHST9YFPdQsEqNVknUb7R25TwQmvAqegVx1Zv3DefVjSXw
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: EB3A3F24B6B44672A9EC7A1A6A776603 Ref B: TYBEDGE0515 Ref C: 2024-09-20T13:15:36Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYijNWw32TbHXohMXVdog==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 20 Sep 2024 13:15:36 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838135812&li_adsId=caed7681-708e-48fb-a5ba-6138ac1612a3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&e_ipv6=AQJKQ5349KwTjwAAAZIPkty4nHST9YFPdQsEqNVknUb7R25TwQmvAqegVx1Zv3DefVjSXw
x-msedge-ref: Ref A: 7B9BC81697DE45D5A3CCE4B51064CB01 Ref B: TYAEDGE0819 Ref C: 2024-09-20T13:15:35Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYijNWuFI9b8D70JebSfw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 20 Sep 2024 13:15:36 GMT

GET

usersync
tracking.contanuity.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838134717
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838134717&_bee_ppp=1
https://tracking.contanuity.com/usersync?bwcookie=AAFiGU7N2usAABSEM6DVvA

0
0

GET
H/1.1 200
OK st Show response
px.mountain.com/ 2 KB
1 KB 529ms
132ms Script
application/javascript 52.42.124.195
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1671318838.1726838133&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221671318838.1726838133%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838132.1%22%2C%22mntnis%22%3A%22soIAljY1ENSz%2Fio0TO6OCC0WaOirVyGZ%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A6%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838132.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838132%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838134%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=7959104353123880term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=7959104353123880term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.42.124.195 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-42-124-195.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 4dabb0fb260bc90f4d588131535e6a42a7869761252cd179c8536ea2de8e2081

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 0
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:36 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
196 B 185ms
184ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 37F2714EAF5C4D21A4DDA88DAA224D5F Ref B: TYAEDGE0819 Ref C: 2024-09-20T13:15:36Z
x-li-fabric: prod-ltx1
access-control-allow-credentials: true
x-li-uuid: AAYijNWzg7nVI4c1TCLHbw==
x-li-proto: http/2
access-control-allow-origin: https://www.fortinet.com
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:36 GMT
vary: Origin

GET
H/1.1 200
OK gs Show response
gs.mountain.com/ 144 B
733 B 490ms
127ms Script
application/javascript 52.12.117.226
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gs.mountain.com/gs
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1671318838.1726838133&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221671318838.1726838133%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838132.1%22%2C%22mntnis%22%3A%22soIAljY1ENSz%2Fio0TO6OCC0WaOirVyGZ%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A6%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838132.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838132%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838134%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=7959104353123880term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.12.117.226 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-12-117-226.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 4b50dd36c60066a5ba031b16f211f5d1d5c7662384fb0d83889dcf308be46b78

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 2
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:37 GMT
content-length: 144
content-type: application/javascript;charset=utf-8
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 167ms
167ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A35%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%225096%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:36 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:36 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 5 KB
2 KB 366ms
134ms Script
application/javascript 52.42.124.195
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1671318838.1726838133&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221671318838.1726838133%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838132.1%22%2C%22mntnis%22%3A%22soIAljY1ENSz%2Fio0TO6OCC0WaOirVyGZ%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A6%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838132.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838132%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838134%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue&cb=1726838136536147&shguid=a2bf8823-a350-3f04-8327-6ff348bacf2f&shgts=1726838137040
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1671318838.1726838133&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221671318838.1726838133%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838132.1%22%2C%22mntnis%22%3A%22soIAljY1ENSz%2Fio0TO6OCC0WaOirVyGZ%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A6%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838132.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838132%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838134%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=7959104353123880term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.42.124.195 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-42-124-195.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 8891795a81a887d04440c05a4f7aee5f1a2840b14f5e288669be5e771fcd5696

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 16
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:37 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H/1.1

200
OK

tdsync
px.steelhousemedia.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=6ca2165b-7752-11ef-8b02-814c35b12fb6&gdpr=&gdpr_consent=
https://px.steelhousemedia.com/tdsync?tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&shguid=6ca2165b-7752-11ef-8b02-814c35b12fb6

0
319 B

637ms
186ms

Image
text/plain

44.237.157.168
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.steelhousemedia.com/tdsync?tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&shguid=6ca2165b-7752-11ef-8b02-814c35b12fb6
Protocol: HTTP/1.1
Server: 44.237.157.168 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-237-157-168.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 52
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:37 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

Redirect headers

location: https://px.steelhousemedia.com/tdsync?tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&shguid=6ca2165b-7752-11ef-8b02-814c35b12fb6
content-length: 277
date: Fri, 20 Sep 2024 13:15:37 GMT
server: Kestrel

GET

v2
usermatch.krxd.net/um/
Redirect Chain

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3
https://dpm.demdex.net/ibs:dpid=903&dpuuid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://tags.bluekai.com/site/5386?id=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YWNmYjdkYjUtMGEwMC00YWM0LThmMzAtYTFjZDEzYTVkYTY2&gdpr=0&gdpr_consent=&ttd_tdid=acfb7db5-0a00-4ac4-8f30-a1cd1...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66&google_gid=CAESECL1XExDpWnJgbjwjz_GYv8&google_cver=1
https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66

0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 188ms
187ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A36%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226097%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:37 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:37 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 173ms
173ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A38%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A37%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%227097%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:38 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:38 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 169ms
168ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A39%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A38%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%228097%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:39 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:39 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 171ms
170ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=787dd5de-a0c2-4641-8a85-40d498b8d711&session=476c5ed8-92a0-4a6f-8f65-fa23750e31e3&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A39%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%229098%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=1faea448-21f6-422b-8d5f-05ebe3d40a6a&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:40 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:40 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.fortinet.com
URL: blob:https://www.fortinet.com/19027954-8fbb-420c-8986-346cfdb4b499

Domain: ad.doubleclick.net
URL: https://ad.doubleclick.net/activity;register_conversion=1;src=10050195;npa=0;auiddc=1777323958.1726838133;ps=1;pcor=1919840651;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9191763579;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Domain: tracking.contanuity.com
URL: https://tracking.contanuity.com/usersync?bwcookie=AAFiGU7N2usAABSEM6DVvA

Domain: usermatch.krxd.net
URL: https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66

Verdicts & Comments Add Verdict or Comment

162 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

111 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-21 08:26:14	Name: cookiesession1 Value: 678A3E237229F6D60930BB1FF4D2E201
.fortinet.com/	1970-01-21 08:26:14	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Fri+Sep+20+2024+22%3A15%3A30+GMT%2B0900+(%E6%97%A5%E6%9C%AC%E6%A8%99%E6%BA%96%E6%99%82)&version=6.10.0&hosts=&consentId=d9ed4d71-3cbf-4024-98fd-48c160c45453&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.fortinet.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-21 03:59:50	Name: demdex Value: 41693660238315688000305167721532418661
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
.fortinet.com/	1970-01-20 23:40:39	Name: mboxEdgeCluster Value: 32
.fortinet.com/	1970-01-21 09:16:38	Name: mbox Value: session#76ffc8b03eea4dfda0815feac1fcbea9#1726839992\|PC#76ffc8b03eea4dfda0815feac1fcbea9.32_0#1790082932
.dpm.demdex.net/	1970-01-21 03:59:50	Name: dpm Value: 41693660238315688000305167721532418661
.fortinet.com/	1970-01-21 09:16:38	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 179643557%7CMCIDTS%7C19987%7CMCMID%7C41328116926074306960340600619888331757%7CMCAAMLH-1727442930%7C11%7CMCAAMB-1727442930%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1726845330s%7CNONE%7CMCSYNCSOP%7C411-19994%7CvVersion%7C5.5.0
www.fortinet.com/	1970-01-21 09:16:38	Name: _gd_visitor Value: 787dd5de-a0c2-4641-8a85-40d498b8d711
www.fortinet.com/	1970-01-20 23:40:52	Name: _gd_session Value: 476c5ed8-92a0-4a6f-8f65-fa23750e31e3
.simpli.fi/	1970-01-21 08:27:40	Name: suid Value: 98F335567E784DE4B818938C71A8A5CC
.fortinet.com/	1970-01-20 23:42:04	Name: _uetsid Value: 69bed6f0775211efaa4be963648c7238
.fortinet.com/	1970-01-21 09:02:14	Name: _uetvid Value: 69bf6900775211efa35c3391c83902dd
.bing.com/	1970-01-21 09:02:14	Name: MUID Value: 1D088A65536D6777170B9F655209664D
.bat.bing.com/	1970-01-20 23:50:42	Name: MR Value: 0
.fortinet.com/	1969-12-31 23:59:59	Name: _ce.irv Value: new
.fortinet.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.fortinet.com/	1970-01-20 23:42:04	Name: _ce.clock_event Value: 1
.fortinet.com/	1970-01-20 23:40:39	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
.fortinet.com/	1970-01-21 01:50:14	Name: s_getNewRepeat Value: 1726838132061-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
www.fortinet.com/	1970-01-20 23:40:38	Name: dicbo_id Value: %7B%22dicbo_fetch%22%3A1726838132090%7D
.fortinet.com/	1970-01-20 23:42:04	Name: _ce.clock_data Value: 56%2C146.70.201.218%2C1%2Ccd70ceeb4a1768030b1882c90242a428%2CChrome%2CJP
.fortinet.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.fortinet.com/	1970-01-21 08:26:14	Name: _ce.s Value: v~2f9599eefdac8a6ec5ee8cb4d77734c991d7c416~lcw~1726838132286~lva~1726838132030~vpv~0~v11.cs~424000~v11.s~6a1947c0-7752-11ef-ad9d-170a7890a719~lcw~1726838132289
.fortinet.com/	1970-01-21 09:16:38	Name: _ga_38BQ9XFDT4 Value: GS1.1.1726838132.1.0.1726838132.0.0.0
.fortinet.com/	1970-01-21 09:16:38	Name: _ga Value: GA1.1.1671318838.1726838133
.fortinet.com/	1970-01-21 01:50:14	Name: _gcl_au Value: 1.1.1777323958.1726838133
www.fortinet.com/	1970-01-21 09:16:38	Name: _omappvp Value: e69R51TpdTTYH8oisQrPrujoWC8syDD4BMsC745UnlQRG5OgX0YsuTbeh3gGl8Hdu2vOH87TuhseXJyIXTnxe5tyhFXp2XCY
www.fortinet.com/	1970-01-20 23:40:39	Name: _omappvs Value: 1726838132907
.techtarget.com/	1970-01-20 23:40:39	Name: __cf_bm Value: 5mxYiim75XJ_8PLFZWX57tPtYFJaowhWmugnAzbkz4g-1726838133-1.0.1.1-bLKwlOamO_Nw_jAkQPQD3coua88W54RvIqjxXKG15_2w9d2x6Pv.o8osBe6XLvHXGEwnqzbELR3hsDzFCnW2_Q
.www.fortinet.com/	1970-01-21 08:26:14	Name: WID_VISITOR_ID Value: 1726838134452598664
.doubleclick.net/	1970-01-21 03:59:50	Name: receive-cookie-deprecation Value: 1
.doubleclick.net/	1970-01-21 09:16:38	Name: IDE Value: AHWqTUlSNuzBW4TGobWIRhKeolwXHCJzpG3lWLMD8Fdk8Ygke1ju_W3h97BJvslS
.fortinet.com/	1970-01-21 09:16:38	Name: _ga_JH142QCQCJ Value: GS1.1.1726838134.1.0.1726838134.0.0.0
.simpli.fi/	1970-01-20 23:50:42	Name: uid_syncd_secure Value: true
www.fortinet.com/	1970-01-20 23:50:42	Name: AWSALB Value: CVHPLup2HO8IfNZxIfjaV0ibn99mmCzw65d17y30boaNrVfZH4qdgA48gFLcrYOWkDJ3mw6M1CXYbmjf9G/AsR4teOliXwTIYktdpSJmQ06BxJCeIxbx4nYQ74T9/8Kww3QRJ1x0T7uysftgDWxpdGg5IXynlibXs/GCmJptAmIWJxjQmmokh+JoCpEAqx0NMGtbHsBqOKjLY4SLLPSkSVQFasZ9J+60
www.fortinet.com/	1970-01-20 23:50:42	Name: AWSALBCORS Value: zeXl1X7C60rY3x5XRSRrCXJdr1MwRBSljA+kYq1xRw1rzXkN3kIBfy222l96KubIzC1rApoA16i6k7KjNZKqzCGNbFSGm5dgNwxA791V2QfibOgudgRTWuAKcXfYHgsQU6glblkqoze1QKFo0KUFUr0RAiG8Zy4ZK/PhbxAJKloquQNDiyxeyP5t0kXYETtsEtPDxUavUtPILhaEGx3PyvwbD8Gm6tRm
abm-tracking.demandscience.com/	1970-01-21 09:16:38	Name: userId Value: d13d32f58501fd8aea71a13fdffce4b8_1726838134717
.adnxs.com/	1970-01-21 09:16:38	Name: receive-cookie-deprecation Value: 1
www.fortinet.com/	1970-01-20 23:42:06	Name: aa_cc Value: RO
www.fortinet.com/	1970-01-20 23:42:06	Name: aa_cn Value: Romania
www.fortinet.com/	1970-01-20 23:42:06	Name: 6scexist Value: true
.t.co/	1970-01-21 09:16:38	Name: muc_ads Value: 41152863-f339-4fd7-a79b-948f8459746f
.t.co/	1970-01-20 23:40:39	Name: __cf_bm Value: vyFUFTZXR8tStlBN5jt3H3o0h6W3lafTjt.jkHS5Rjk-1726838135-1.0.1.1-YLz2HFff0CZfZ9NWNljmo75Hu76EuPAevlW2SFS0ayfac2Ohy6UvR0.u9u72qnPas98u0frJue4ZodBjcCRkMg
.fortinet.com/	1970-01-21 09:16:38	Name: nmstat Value: 6559f4e9-da87-2381-10ec-c3ec41bbe72a
.twitter.com/	1970-01-21 09:16:38	Name: personalization_id Value: "v1_9EzbegKytfpCf7wRJZEmFw=="
.doubleclick.net/	1970-01-21 00:23:50	Name: ar_debug Value: 1
.fortinet.com/	1970-01-21 01:50:14	Name: _fbp Value: fb.1.1726838135444.552701973432516314
.adnxs.com/	1970-01-21 01:50:14	Name: XANDR_PANID Value: sLGC7d5tUzMkDM3Pa9IRbCE6lYfVY_Sm4y5-F5cPdI3MujtxOHgzC_olYAkzUrHD1tgahImSO6sLXyNT30kEz1AByOVYpxPXCGuwe_rtTwc.
.adnxs.com/	1970-01-21 01:50:14	Name: uuid2 Value: 1696893782454554117
.linkedin.com/	1970-01-21 01:50:14	Name: li_sugr Value: f247f381-beaf-472d-87a1-6fbc5467498b
.linkedin.com/	1970-01-21 08:26:14	Name: bcookie Value: "v=2&5002a855-8b02-407a-8c7a-6fbab7ca6779"
.linkedin.com/	1970-01-20 23:42:04	Name: lidc Value: "b=TGST04:s=T:r=T:a=T:p=T:g=3297:u=1:x=1:i=1726838135:t=1726924535:v=2:sig=AQGJNMFv60tcqwdfiWBmIk9wFxUAvzQK"
.agkn.com/	1970-01-21 08:26:14	Name: ab Value: 0001%3ADfxExEYuIKI7sWNw7KooLI0xeygr8%2Bt0
.smaato.net/	1970-01-21 00:10:52	Name: SCM Value: 6499164f1c
.smaato.net/	1970-01-21 00:10:52	Name: SCMsas Value: 6499164f1c
.smaato.net/	1970-01-21 00:10:52	Name: SCM1001136 Value: 6499164f1c
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_TS Value: 1726838135618
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_DID Value: 18c3c39d-46ec-4f8f-86ca-59645ebe970b
.adnxs.com/	1970-01-21 01:50:14	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2In@qOe]Z!]tbPl1N!7OnM$=BX(sh1P`zjFLczlvv#OjatWLi+.8edZ-dpiHJ?akni<4]313/X%W#.wL4W1Qw2c(2N*F
.agkn.com/	1970-01-21 08:26:14	Name: u Value: C\|0AAAAAAAALoAx9wAAAAAA
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_3WAY_SYNCS Value:
.1rx.io/	1970-01-21 08:26:14	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-eeb83afc-6957-463d-88ab-ad072def41b0-004%22%7D
.linkedin.com/	1970-01-21 00:23:50	Name: UserMatchHistory Value: AQK9x9h6Y_u58AAAAZIPktt92uudAnIALa8KCoa4tvU4_lYTdjnKXrUkX4XLb9hGX2l6uMwbxbBo8Q
.linkedin.com/	1970-01-21 00:23:50	Name: AnalyticsSyncHistory Value: AQLovGOMieXA8wAAAZIPktt-W9R6ahqKgBTaFkajAn-XdNr2hFJn9OvwR9NNG2zYyAotppoJp4lKqKsAIH4Qww
.bluekai.com/	1970-01-21 04:01:16	Name: bku Value: blx99c5NfVSw9vAF
.ml314.com/	1970-01-21 08:26:14	Name: pi Value: 3647144422797738056
.ml314.com/	1970-01-21 00:00:47	Name: tp Value: 3%253B09%252F20%252F2024%2B13%253A15%253A35%253B0
.rlcdn.com/	1970-01-21 01:07:02	Name: pxrc Value: CPfqtbcGEgYIuuoBEAA=
.intentiq.com/	1970-01-21 09:16:38	Name: IQver Value: 1.9
.intentiq.com/	1970-01-21 09:16:38	Name: intentIQ Value: RU1OFjWb2Q
.3lift.com/	1970-01-21 01:50:14	Name: tluidp Value: 893470529329053992521
.3lift.com/	1970-01-21 01:50:14	Name: tluid Value: 893470529329053992521
.crwdcntrl.net/	1969-12-31 23:59:59	Name: _cc_cc Value: ctst
.adsrvr.org/	1970-01-21 08:26:14	Name: TDID Value: acfb7db5-0a00-4ac4-8f30-a1cd13a5da66
tracking.contanuity.com/	1970-01-21 09:16:38	Name: userId Value: d13d32f58501fd8aea71a13fdffce4b8_1726838134717
tracking.contanuity.com/	1970-01-21 09:16:38	Name: clientId Value: undefined
.rubiconproject.com/	1970-01-21 08:26:14	Name: khaos Value: M1AQU97Y-T-AZQH
.rubiconproject.com/	1970-01-21 08:26:14	Name: khaos_p Value: M1AQU97Y-T-AZQH
.rubiconproject.com/	1970-01-21 01:50:14	Name: receive-cookie-deprecation Value: 1
.smartadserver.com/	1970-01-21 09:09:26	Name: pid Value: 2355805861892627342
.smartadserver.com/	1970-01-21 09:09:26	Name: TestIfCookieP Value: ok
.smartadserver.com/	1970-01-21 08:26:14	Name: csync Value: 133:6499164f1c
.pro-market.net/	1970-01-21 00:23:50	Name: anHistory Value: "-1wlkfp52s0eku+2+!#7%.$z!T+g"
.ml314.com/	1970-01-20 23:40:38	Name: u Value: aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLw%3D%3D
.www.linkedin.com/	1970-01-21 08:26:14	Name: bscookie Value: "v=1&202409201315354c2fe8ec-cdcc-4cec-809e-20383a9b46d9AQH-LaSrxZAHbmpWYUIQEtqe4Mu-1v5f"
.eyeota.net/	1970-01-21 08:26:14	Name: mako_uid Value: 1920f92dc8a-17dd0000010e533d
.eyeota.net/	1970-01-20 23:40:38	Name: SERVERID Value: 21309~DM
.bidr.io/	1970-01-21 09:09:11	Name: bito Value: AAFiGU7N2usAABSEM6DVvA
.bidr.io/	1970-01-21 09:09:11	Name: bitoIsSecure Value: ok
.intentiq.com/	1970-01-21 09:16:38	Name: ASDT Value: 0
.intentiq.com/	1970-01-21 09:16:38	Name: IQPData Value: 2454112730#1726838135873#0#1726838135873
.intentiq.com/	1970-01-21 09:16:38	Name: intentIQCDate Value: 1726838135877
.intentiq.com/	1970-01-21 09:16:38	Name: CSDT Value: UEQ6MTAwNDNfMCZVT3Y2cHEy
.lijit.com/	1970-01-21 08:26:14	Name: ljt_reader Value: JXQbAQZH6hOKgOQAS3CIJzzu
.targeting.unrulymedia.com/	1970-01-21 08:26:14	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-eeb83afc-6957-463d-88ab-ad072def41b0-004%22%7D
.lijit.com/	1970-01-21 08:26:14	Name: _ljtrtb_2 Value: 98F335567E784DE4B818938C71A8A5CC
.pro-market.net/	1970-01-21 03:59:50	Name: anProfile Value: "-1wlkfp52s0eku+1+1f=1+1g=1+1j=12+rs=s+rt=20010AC80040001E000000000000002E+s2=(sk44tz)+vm=24-98F335567E784DE4B818938C71A8A5CC:53-CAESEOldn0wlwC08_nQOyafyfgQ"
.bfmio.com/	1970-01-21 08:26:14	Name: __141_cid Value: 98F335567E784DE4B818938C71A8A5CC
.bfmio.com/	1970-01-21 08:26:14	Name: __io_cid Value: 0272e75fdfe374c01e32f3ef606cbd19cec4661b
.exelator.com/	1970-01-21 02:33:26	Name: EE Value: "473b9408b202863740090e07648dd916"
.mountain.com/	1970-01-21 08:26:14	Name: guid Value: 6ca2165b-7752-11ef-8b02-814c35b12fb6
.exelator.com/	1970-01-21 02:33:26	Name: udo Value: "gAAAAAQAAAUlKLUv%252FWAlBIUaAPYtqUgQjVgHABAAQFhEQBgcAFR234%252BOdthvYdQIllWEqJc8T35ZJ824MExLRfocvBpVrACvYzTIUr04t%252BUHSZNwAyCBnhOVQwkwGymVAJQAkAB7BJl9f2LHBlVy1rDMxNzlZsO72QlVTqbSiGNS8u6BHV6lpLUVfScgjtjxNt37dNg1bsQg0vR8OIrOcq7QWrM4nlnyccNFF288%252FOsgU%252Fw632GHUxD8CPVVTyWvE5yq%252FgWgvqMJCRCiVp57KPH%252FE9%252FS0tLyBv4fwIJnGYFT1bgRg4zatWQCiQwDMkz8h3Df%252BECbwqoLAR0dmVwrkvITPVebviaWtHpg1LO0um06dlBBS2cIPdc21DK3p5U7tKkrYW01rS3TXMZlsE1reOGWFfEwrRykNsi%252F7m3SS2GhpK56fpiYXMPJXoooautiUnZtTSlm0zBSSkjy1lmKQZI%252FAG2OkuUgRW6RJL31HZ2viYazFINIHm7T%252BzSf0rVFDs6%252FE1CEVdj1FXFTcBUrK2yqApaigAJ5YOeYZg936UJx9HDsHZxVgR9x6rHOGeuyE68Dchqz0BmzyJtFRtMcylHsDzyyw62xFDMde7gYbjKjOxTltMyW09zlrG1ZhsMyFuKy1oWyTcM8Cyh%252BVB2mVeTuYIGURq%252B7ikAQODl%252B34XHeXr7uKzjNKfRNqhx294yFxdZtuE6zLN0NqWWsTKPgeJ%252F5UNoXDQuIC4vAgVhVS%252BWNFKhWI%252F49fERUr1cF1VlFBYq%252Fj%252BBgCfwEz9BYeExMK0zGWgIQ2eRm%252FGB0eBZ1BVluUhanUXOiMDgDFEwblScIRxCj8fp3mcleksryfUSEbmiklcJihqXDyMn2LosbNMyJZx6qhhRRyfaQq1ebulM1U89Rx4p66KQeERN55%252FrHwPFB5CUxuUDmgpCIEACQpBDZh70hbOY5PwVFsgkdZUkLYc6CcFndyjweXLWPMSyBQaojcMxKfr1SCRdE%252BGYAE1s4WxxT7GFzK7dB3VaVBBfA2YPtSW442ODiRHBCaCDXPALJsnSxXtBLvwsfYPUCW9RRvwuiqxz0Jq4sF42D2z1eBUD05QFKjNz38IcCMc4Hwy%252BpOWpVMLf%252BzVuZwLXagWntem7EQRYfWgMMyjL2N7vwyUD"
.exelator.com/	1970-01-21 02:33:26	Name: ud Value: "eJxrXxzq6XKLQcHE3DjJ0sTAIsnIwMjCzNjcxMDA0iDVwNzMxCIlxdLQbHFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDIckl%252BUWb6Iq%252BAxUUpaQyLSopPBZ9kPwkAL7Eo%252BQ%253D%253D"
.px.mountain.com/	1970-01-21 08:26:14	Name: tt Value: "H4sIAAAAAAAAAKtW8guKNzYyNjaLNzK3NFayMtBRgnItjC2UrAzNjcyADENjc2NLUx2lMiUrIx0kLWA1BrUADukY6EYAAAA="
.mountain.com/	1970-01-21 08:26:14	Name: rt Value: "MzIzMzY6MTcyNjgzODEzNw=="
.rubiconproject.com/	1970-01-21 08:26:14	Name: audit_p Value: 1\|xYSK93YvEsNCFni+WuxHECMIH9o291BsAha1Qz5w06ARdwtRav1lhn2f35FaxAWYwR4RckjDUyaM1KxoLazIt04KBbjzRD/Y5dDZuxGLGk9AIUfbwd4GTSIVFnBZ/BdpaUnRwvcBmN6FsiaxEny9BRZj8EjIuS2MSpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.rubiconproject.com/	1970-01-21 08:26:14	Name: audit Value: 1\|xYSK93YvEsNCFni+WuxHECMIH9o291BsAha1Qz5w06ARdwtRav1lhn2f35FaxAWYwR4RckjDUyaM1KxoLazIt04KBbjzRD/Y5dDZuxGLGk9AIUfbwd4GTSIVFnBZ/BdpaUnRwvcBmN6FsiaxEny9BRZj8EjIuS2MSpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.adsrvr.org/	1970-01-21 08:26:14	Name: TDCPM Value: CAESFgoHZDB0cm8xahILCNbM04uL4Kw9EAUSEgoDYWFtEgsImviju9GtoT0QBRIWCgdydWJpY29uEgsI2tiKm4vgrD0QBRIWCgdibHVla2FpEgsI3LPpm4vgrD0QBRIVCgZnb29nbGUSCwi0lOmdi-CsPRAFEhMKBGtydXgSCwi0vpO-0a2hPRAFGAUgBCgBMgsIvtH8x6HgrD0QBUIVIhMIARIPCgtOTyBUcnVPcHRpaxABWgc2czB6YWV1YAFyBGtydXg.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838134452598664&event_type=page_request&timestamp=1726838134&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838134452598664&event_type=page_request&timestamp=1726838135&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=acfb7db5-0a00-4ac4-8f30-a1cd13a5da66 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
401.tw
6033413.global.siteimproveanalytics.io
a.omappapi.com
a.opmnstr.com
aa.agkn.com
abm-tracking.demandscience.com
ad.doubleclick.net
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
b.6sc.co
bat.bing.com
bcp.crwdcntrl.net
c.6sc.co
cdn.cookielaw.org
cdn.jsdelivr.net
ce.lijit.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
d.agkn.com
dpm.demdex.net
dx.mountain.com
eb2.3lift.com
epsilon.6sense.com
fei.pro-market.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
i.simpli.fi
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
intentstream.contanuity.com
ipv6.6sc.co
j.6sc.co
loadm.exelator.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
pbid.pro-market.net
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
pixels.argusplatform.com
ps.eyeota.net
px.ads.linkedin.com
px.mountain.com
px.steelhousemedia.com
px4.ads.linkedin.com
rtb-csync.smartadserver.com
s.ad.smaato.net
script.crazyegg.com
secure.adnxs.com
simplifi.partners.tremorhub.com
siteimproveanalytics.com
snap.licdn.com
stags.bluekai.com
static.ads-twitter.com
sync.1rx.io
sync.bfmio.com
sync.crwdcntrl.net
sync.intentiq.com
sync.targeting.unrulymedia.com
t.co
tag.simpli.fi
tags.inzynk.io
td.doubleclick.net
tmp.argusplatform.com
tr.outbrain.com
tracking.contanuity.com
tracking.crazyegg.com
trk.techtarget.com
um.simpli.fi
us-u.openx.net
usermatch.krxd.net
wave.outbrain.com
webtracker.argusplatform.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.co.jp
www.google.com
www.googleadservices.com
www.googletagmanager.com
ad.doubleclick.net
tracking.contanuity.com
usermatch.krxd.net
www.fortinet.com
103.43.89.4
103.43.90.19
104.19.148.8
104.244.42.131
13.107.42.14
13.48.36.94
142.250.196.130
142.250.196.132
142.250.196.98
142.250.76.131
142.251.42.136
142.251.42.162
151.101.228.157
157.240.31.5
162.159.140.229
172.105.230.106
172.217.161.34
172.217.26.230
172.67.163.237
18.138.15.243
18.139.230.53
18.179.63.210
18.182.162.20
23.106.127.56
23.2.37.89
23.207.173.158
23.50.118.161
2400:52e0:1501::1193:1
2404:6800:4004:818::2008
2404:6800:4004:823::200e
2404:6800:4004:825::2002
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
2600:140b:1c00:39::1732:7614
2600:140b:a00:396::1e80
2600:140b:a00:e::b81d:8cdf
2600:1901:0:8eee::
2600:1f18:612b:4264:e3b7:dedd:c6b:bb7b
2600:9000:26f2:6c00:19:fc2c:a140:93a1
2600:9000:2751:3600:12:dfa9:e200:93a1
2600:9000:27af:4400:1b:5138:8a40:93a1
2606:4700:3108::ac42:2af8
2606:4700:4400::6812:2089
2606:4700::6812:1247
2606:4700::6812:562a
2620:1ec:21::14
2620:1ec:33:1::10
2620:1ec:bdf::46
2a03:2880:f10f:83:face:b00c:0:25de
2a04:4e42:600::485
3.164.110.98
34.111.113.62
34.111.208.231
34.117.77.79
34.142.175.23
34.229.3.43
34.87.122.136
34.98.64.218
35.244.154.8
38.133.127.191
43.202.117.154
44.226.187.177
44.237.157.168
44.238.122.172
52.12.117.226
52.223.2.229
52.223.40.198
52.23.38.239
52.32.164.86
52.42.124.195
52.68.127.144
52.88.179.26
54.203.236.163
54.71.108.129
54.92.33.217
63.140.50.191
69.173.158.64
74.118.186.107
74.121.140.211
76.223.9.105
0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096
07405b002bac345765f6de032ed07cac28e77745e73850bf4aed8f891822c37a
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0be9fc1923bfa5bd67a699ff0f49420e460c09b27bcb63dd4d682a0fa2ef5b5a
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
10fc9a12b905f9f21665f11fa5b183eae31166f74fce090bf179eb4c823b5ecc
11c69167edad4aa2ac0c3def81f10e2caf7375ca37d9170e9277ac2cef39eb32
15c2c29198d9315260cc26261e96a036d215fa28a46836302a576392e0e20ecd
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
21aaea8d55693ea73c2e3d8afbf8358f3bfa56ae0d8a0abb07221a83373da2d5
229849a4c44505b2599f1a321b139fb5ab32d04a4e0f8d9844b1827e60b80d9f
2589fe281a342d19f8ddcd924727496b916202c4e42edb2553f25074746db938
291ac3898f3f28bd32810a5ef0f380363afee480e535632f0254da751f775c63
2ac314870072e1aad5c1c2c1ebb9ba542bf1a9df18963c2c4f1d8fcab8711bde
2cc20824e35c6be438211ca8dcf0baa6b8e6df5473454d953a0c96d10eedae7e
2d0ddcf9662d44f133470ee7c926c568e540874718195167d7ce2eae31839a2c
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2eceae481c2cda87ecdc8e65c8bbd62ddc9538144c42ff6c1cd720cd5781623c
2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
320f37b3eca2011055c9ab5a10b5de0f57a22fd740e504fe7e02c9898041abbb
3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a
351ba146db40e108b8dcbf0f9cc288d6cc19615020b2aeb1c0f508b79e78b93e
36cc787b21a3e954008891b38b0a2694aa889c43287923aa39d4d1843214d09a
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
38cfaeb6a3cb2cff2b9b11f9945838fd640ac7c0483e093239a29400c7d2ee66
3d6bc3dbcf9e2cf02f556ae8bd0936e8b62540189823df29c4f524c060bb8328
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
448edbb969fa89cb34eee5b730ff672e2c2b1175ae9786b1ce8557f6bdc1bca8
44fc655655fedce3141e358eabb02c39e838d48e6643b1c58c395adfc23757d2
4713f4e99bebe488012bb9f5ccbaa25d83f2ecec4dbfc2c71f81ad33df9d1c10
4b1017ddd583b8790466a28987a1dabd2d750fcbc0dbffbf263bee2e4cd35791
4b50dd36c60066a5ba031b16f211f5d1d5c7662384fb0d83889dcf308be46b78
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4dabb0fb260bc90f4d588131535e6a42a7869761252cd179c8536ea2de8e2081
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e087b4fdf2d01e82e172c013dadf27dd879737dd595df92fa435f4662538d51
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
5072cb8f4c6522e91c53fa0b2c4a36a3aa078b5b78ac9d48f317649a055a1e1d
59d12a10e99345ccbe1776752be1dcab5d337248fb1f523fb3cf93ffecf3a779
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5b7b4be8ed582776a1ad52eed0fe06afe968c34e31d566c473feb92ac6a270e0
5b7e10ef15a4fdfd73c69fa16e91aef21861455628f5ac87e72bb5f951e9976c
5ef0e68967411e0314dcc9b45416c54100ebf112f0fc6dc08cc3e1f1f9fa0436
5f83323b31dd79cc7f9104b638a2706b0e12b6e521f48d21ba638b67279f4417
609ca44aa6a92944559e4d17e84e29651b391c6c3438184474fd67e602250e7d
61c4417c2b9d4cba0069ef57a404bd5d9c7a7e4c768f57747b1c084cb9b373ce
6277e3210b9fb4b3b4f0d452b7f91bda534fb23f8ecbe7f9b15dcdf85626cea6
6305f99e66b3ae3c375efe4b1128ab3dcdc2d66c63b97ba6b891096de9b20b9d
66a4281a7684239d0eaeb9e42ad71f249a5a452e286acdb9f99040797ff6fb15
6bb4e76fdeac3f86fe514013ea4ec43b69cf824a9cb00b4d90ca33eb27df3712
6c96e2d7e3d052c2c4fc96b42a991077b82cc1118c272a97b8c2880a1ebd9357
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552
6ff3a6b13274ac400ff4d3d39177a0151495114c91cbb7c1330ce2b66a5bebd9
701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f
706300e054788f930de76af585fc6511091289d01c65c440964ca6abb898e7dc
71e3c0057bec6dab5d49a1b6994c8e4fffa97614ba115bc8747a2be7c43ed048
73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4
73ade03dfeae221bb318514f70aa5ae9c9c653b6871008ef9a3596f9255a78f1
76ec385cfb426fdef7dcfb25cf6819385aa1f5bc5bc8ca74ef39d2f0a842fb09
7701282ea59743a1d336ee5ede4e6805ca9572c28ad013fa956fb39f18de0d69
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
7a520fb2812687266f06520e650deb9dece37e49629623c4be612b1f561e11df
7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
7fc88a2ccff93251684fc0526a1ef83f6b65bccc949e449d86f4df1bf945da94
8109fbd42099eef3aed0564d81e4502bade4a64b6bd5174894f0f1e8019cd421
83201017e411b72434080a221b102049e9074e205d97f65219d2286abd683012
845ab3eb76b8e1168bbcb722de86531cc914625c1d8cae783f1c35adbb704c4f
8489534bde4ad3c3cedebecd11b9babe653de6b413922ec2b877c5bfcb33ee3e
8891795a81a887d04440c05a4f7aee5f1a2840b14f5e288669be5e771fcd5696
88a5f8b5bcd4b32ed398b199bfc0ecf20ba41bf544d2ca04bc40111db7c66ab3
89905a0e0efe1119d95b1e69de27157b35b8043115708fa06eb74dc706568a7b
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a84bc1c645bc2d9b6e41e4e8b4582c2dbd3569b51df5ecedc989410e6be8fe7
8b195a98b1a9fa227dd6712c4af7ccbd807baa4a4b21491d97dbc09c1e13798a
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
8d121b33124fce841c6927c1214d2aa4fe7e5c52629de45f68f325f749a5857d
8db92e7cdc1ad40168c42e93b05d842e056d8a5b83ae96b95d2b1c546f828196
8dbdd526d3da8b4924bc169cb3faee88cda6da11742ef935ae2e916a17b7d978
8ff6ee1950e6f70a130f69e94e575f9d5f7c5de60be4be09311deedeb91e6d61
904ada5a93d55f8c5412c4472a62bfbc46e215422ebdea166d95ed3434d97d4f
91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f
930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6
940cc004817de61385850acf62a3ef522796f8f13b86842f7d2439f1149a81b8
94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66
956915db9ed8f96ac4ee123a7909637e7db25f3ea20e41927c5fcc4fd50108ee
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d
9a57c6cd6129a6ae679af72011e4529d2c322ff41ca4933dedd76150ffcae369
9ae293c59bba08f1a56f697a11015ee4b251b0f38c309f83c80d7f6e7369caa4
9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36
9c8a46f991749e270426707815e60c7f21e00c72144b5aaa3cd9a313ecd710ca
9cbf9589d98422a08f788b3863a74d1a27c3d92289f8829620c4d8925b967b94
9f313c8c3aaec2c1b82bdf04b99d12b5b456dd6e4ccb2957e7a584c42683eba5
a036dd51b9d09070b4cb8eaa91c1a5abac51f7027e9741c79343a35411be739c
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a4b0a228372854369707f452fb9124e5bc34319c8c3323b5379111ac9ba4bac6
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aacafc943455fbee6be8a0c9d1b058dda7c90464b9f4975dc50ef33e0b44eb07
ab5b000d7c8c84f2cc6dbaacd88498126fa4b2fcb04cf14ae9fcd8eef9623760
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
accfade6542b43626934d1599a23d727ac194fc7dea3a9bb99856a58ea3a3366
ae7d18a41edd5f27e717f872a1113addddbf1553e00b3db1baefa99b68fda302
af89d0f65e1c53f2831c1b73f25ee3053fddc6551962dc58eada982a2fd99bdd
b124eed22afdf03abf94714c7632d5f462c0fca7725d014a4469f3b4a0f1083d
b133508601dd82610cda75ed20bc034dd90b459dcd74b8b44e75998e38d19477
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
b66a76be051ae670f5c2786172af1a704f1ecdb15aea3c3402fb42b9e5470598
b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb50d0022dac04a6c6a2fc5edf927a4682c8e6b73a970546c75ff118f06ad4e0
bdda9c1c6a0c19bfa11d1c25d17879fb054d11446fa6b54a0bf7cc338acb8614
bffa4af378368e7e6bbf1bc1bfb72b986f4a4c19671abf63de7b403e2a62bdcc
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869
c3a522b15c8dd585c2cb4e503fdce8145d08a8eccb0e2cd7138864bba293c843
c606f50ac3bdb01ca0e7959384ecd7d9cdf670a23594c9b5f945bd7ec8422c9e
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86
c6c7eafdd4ce7cbca90175e42e4d11a9ebcfaed70b6471572a0d3d0ae7dde57f
c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cb0975f12465da215a90dd685d2e0cb99df5744093d4bef65edeec2cced59942
cee682bc57d94c16933b0422aa0bd7ad8c7a6e04643eb7ce170e2d5ce6e25b48
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfbffc5a6b6598cb0bf93565da00397f881e0198bf2f24c8d963e4c7cfb45abf
d04f03c209c8b79223d1147dec2771c3e87a401dc1348b7dd10de0aa7d22297f
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2ac7d5402f2266e77a525cf70164ad40fb86b0981530cad5af3e3610a209768
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d4605d3f38a876e45340bcdbdba4553a7eeba8708fb4ae1db1c893a2248f4580
d4ce12f625ecbb5284bc635a7f6c96c4bfd99511761efe7ddadcf8d1c29f9d79
d98bf7483812de53be541b21b22b1cc519065b76ed31780f33bf8254e688812f
da9671920127171a9289888088dc3d9f3b62f2af8c3ac142f456faa1d49eccda
daaa79b81fa49a10852df79446783b9c51de167ee31aaff722e030c6cacc674b
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
df9f1f8f4deeec8193dbcf3074a9e4767db05cc6c3b4dca6a9cafff884fb0816
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e708a54b75ed6fd1fe7886153e485c91697f1ab440feed4efd10262575b7e7cb
e72fc9693b94bd6f4cea4fa172adc70989eca7c72cbdcb48f51ceaa7063ab230
e8f00eb416ad5af6f4524e1b7efd086a2244bf48757eee0fbdf583c20afa1dad
ec58ceb768e02c31b87f084fbe10f719b0c42d29c98fcca298688768c6f899e2
ee555b56d11e10b0a60e50d84be13221d318b328d16a7b59d77bb5dc7007e4d2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f188b1683849ebab2c42aa623674d573d89c3a8b8a533f4e2ec35fe7a9e8000e
f2771985061ab617dd696611136d31d58dba565372eaf86c562d59d8bae3fd9d
f4eef873faaecfdeedc996d3f32d0c4d6775a01d0069afe29eb08e0080159899
f8f726a217af8471c5c0e2c11fca16865b7dc42485185311fcbfa0603a4f7120
f90b5ef7baa9dfccda582eb0ec80a2e2848cd5b3edc866629cda33cf4ff6df48
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fc872fc9e36aa5933777799794400cddfb9be6bb1643cd6e4b154e280c694dfa
fd688f7a638dad7a8d7c394f5443ed8ccb3158d4555937c1e0f51546b2fc9612
fd9f918bd5a22813d48748b8c79e2acaeeb590d217575e0d79d734cba9de7736
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.fortinet.com Open in urlscan Pro 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

233 Requests

86 %HTTPS

28 %IPv6

63 Domains

89 Subdomains

72 IPs

7 Countries

6970 kBTransfer

11081 kBSize

111 Cookies

21 Outgoing links

Page URL History

Redirected requests

233 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.fortinet.com Open in urlscan Pro
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Screenshot
Live screenshot

Full Image

233
Requests

86 %
HTTPS

28 %
IPv6

63
Domains

89
Subdomains

72
IPs

7
Countries

6970 kB
Transfer

11081 kB
Size

111
Cookies

233 HTTP transactions
2 data transactions