www.fortinet.com Open in urlscan Pro
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd  Public Scan

URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Submission: On April 18 via api from DE — Scanned from DE

Summary

This website contacted 10 IPs in 4 countries across 7 domains to perform 64 HTTP transactions. The main IP is 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 140698.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 5th 2023. Valid for: a year.
This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
45 2a05:d014:f3c... 16509 (AMAZON-02)
6 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
5 2a02:26f0:480... 20940 (AKAMAI-ASN1)
2 95.101.75.185 20940 (AKAMAI-ASN1)
1 2a02:26f0:710... 20940 (AKAMAI-ASN1)
1 176.34.140.246 16509 (AMAZON-02)
2 13.248.142.121 16509 (AMAZON-02)
1 2 63.140.62.222 15224 (OMNITURE)
64 10
Apex Domain
Subdomains
Transfer
47 fortinet.com
www.fortinet.com — Cisco Umbrella Rank: 140698
metrics.fortinet.com — Cisco Umbrella Rank: 323239
4 MB
6 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 306
126 KB
5 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 427
136 KB
3 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5885
c.6sc.co — Cisco Umbrella Rank: 9001
ipv6.6sc.co — Cisco Umbrella Rank: 6019
18 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9083
708 B
1 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 233
542 B
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 535
306 B
64 7
Domain Requested by
45 www.fortinet.com www.fortinet.com
6 cdn.cookielaw.org www.fortinet.com
cdn.cookielaw.org
5 assets.adobedtm.com cdn.cookielaw.org
assets.adobedtm.com
2 metrics.fortinet.com 1 redirects
2 epsilon.6sense.com j.6sc.co
1 dpm.demdex.net assets.adobedtm.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 j.6sc.co www.fortinet.com
1 geolocation.onetrust.com cdn.cookielaw.org
64 10
Subject Issuer Validity Valid
*.fortinet.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-05 -
2024-08-04
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2024-03-01 -
2024-12-31
10 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2023-11-13 -
2024-11-12
a year crt.sh
assets.adobedtm.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-11 -
2024-08-10
a year crt.sh
6sc.co
R3
2024-04-09 -
2024-07-08
3 months crt.sh
*.demdex.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-09-26 -
2024-10-26
a year crt.sh
*.6sense.com
Amazon RSA 2048 M03
2024-03-31 -
2025-04-29
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Frame ID: 439315E4AC6D06985E6A26CF5A4B66D5
Requests: 65 HTTP requests in this frame

Screenshot

Page Title

Botnets Continue Exploiting CVE-2023-1389 for Wide-Scale Spread | FortiGuard Labs

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc/designs/
  • /etc\.clientlibs/

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Page Statistics

64
Requests

98 %
HTTPS

56 %
IPv6

7
Domains

10
Subdomains

10
IPs

4
Countries

3904 kB
Transfer

5475 kB
Size

11
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64
  • https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.26.0-LDQM/s26351098886453?AQB=1&ndh=1&pf=1&t=18%2F3%2F2024%2016%3A21%3A24%204%20-120&fid=578043B96BA009B9-0D8B876F5B627889&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
  • https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.26.0-LDQM/s26351098886453?AQB=1&pccr=true&vidn=331096323EE81DE8-40001AFEE219300E&ndh=1&pf=1&t=18%2F3%2F2024%2016%3A21%3A24%204%20-120&fid=578043B96BA009B9-0D8B876F5B627889&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

64 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
www.fortinet.com/blog/threat-research/
81 KB
24 KB
Document
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
fa943374519bbb0d7c9792c51165fbe3622f5b73e73f9cc5d08800be959d5fd7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Accept-Ranges
bytes
Age
57093
Cache-Control
max-age=600, public, s-maxage=10800
Connection
keep-alive
Content-Encoding
gzip
Content-Length
22896
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Type
text/html;charset=utf-8
Date
Thu, 18 Apr 2024 14:21:13 GMT
ETag
"14552-616526478a466-gzip"
Last-Modified
Wed, 17 Apr 2024 22:29:49 GMT
Server
Apache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Id
sdLtHlmK2oTlCBBOHlXEjh0GBOrNgfgo4-qAyFQdqlftpPUgCbIG8g==
X-Amz-Cf-Pop
FRA60-P3
X-Cache
Hit from cloudfront
X-Content-Type-Options
nosniff
X-Dispatcher
dispatcher2uswest1
X-Frame-Options
SAMEORIGIN
X-Vhost
publish
X-XSS-Protection
1; mode=block
visitorapi.min.js
www.fortinet.com/etc/designs/fortinet/adb-target/
64 KB
30 KB
Script
General
Full URL
https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Sat, 13 Apr 2024 05:41:40 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
463181
Connection
keep-alive
Content-Length
29532
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 15 Feb 2024 21:43:32 GMT
Server
Apache
ETag
"fe2d-6117284c96900-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
Qt4S1AU9lrTAcyO1Nvvm1moTbRRgpfgHM1fKIcEEeg8KMRln6FvtXw==
at.js
www.fortinet.com/etc/designs/fortinet/adb-target/
104 KB
48 KB
Script
General
Full URL
https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Sat, 13 Apr 2024 14:25:26 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
431756
Connection
keep-alive
Content-Length
47782
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 21 Mar 2024 20:59:39 GMT
Server
Apache
ETag
"19e83-61431fc4b24c0-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
vw5u-IJSaM3xMxymS5HHPHl0AAz6k-GkKEU8u30mmU_eDn9htLNK1A==
clientlib-base.min.dd0a483149c256850fa49d2e21abf149.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/
540 KB
28 KB
Stylesheet
General
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.dd0a483149c256850fa49d2e21abf149.css
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
bf19e4cab46ebfd04a1438e21bc98c6f520c476918f71d44a96d2523fe0abec4
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Thu, 18 Apr 2024 14:20:32 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
1184579
Connection
keep-alive
Content-Length
27479
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 01 Feb 2024 21:53:13 GMT
Server
Apache
ETag
"86e18-6105905a38440-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css;charset=utf-8
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
6dq7u-F4k_YMP0ya9QCySvXx0AsE79Hq7XOS8DVHhZcS-rGtzWv2lg==
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f08699117c1f15f6d35e7b4380d12d18a1881f075e177b5853b1017a3307544
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 18 Apr 2024 14:21:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
zgTRIDojRJmnmBTwUyI2Vw==
age
3
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6882
x-ms-lease-status
unlocked
last-modified
Tue, 16 Apr 2024 07:41:13 GMT
server
cloudflare
etag
0x8DC5DE897C0290E
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
f7dc4b77-c01e-0030-5118-90874c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
87654d05aef21e31-FRA
expires
Fri, 19 Apr 2024 14:21:22 GMT
fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/
32 KB
3 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Thu, 11 Apr 2024 12:03:48 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
613053
Content-Disposition
attachment; filename="fortinet-logo-white.svg"
Connection
keep-alive
Content-Length
1998
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 22 Feb 2018 23:16:01 GMT
Server
Apache
ETag
"7ebb-565d53a1d6e40-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
image/svg+xml
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
d3ZW20aoL4fWR_-rsFIFyzeS5zcAo4s5md-grMeVkIj6AV6ZFT4OlA==
toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/
1 KB
3 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Thu, 18 Apr 2024 14:16:11 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
13466818
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
1277
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 14 Nov 2023 17:34:13 GMT
Server
Apache
ETag
"4fd-60a2031eb4f40"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
R1KEV8SPwUZvY9jARj6A03kHWx8YNQyl2d7tyf0p4doHebOcLyPHMQ==
clientlib-base.min.45f6c0bdb03736a410d54befc06568ae.js
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/
156 KB
73 KB
Script
General
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.45f6c0bdb03736a410d54befc06568ae.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
f95b62f026ed0d8161a753024fcd4e7c5f8677feb314645900ea53e1a832174b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Wed, 17 Apr 2024 10:56:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
98683
Connection
keep-alive
Content-Length
72950
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 01 Feb 2024 21:53:13 GMT
Server
Apache
ETag
"2709b-6105905a38440-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
application/javascript;charset=utf-8
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
qnad05lhTLsBZd8F129vL1YiYP38tApTUL8ndtvAAf7OUiHNj3kK2g==
f85f39fc-d7aa-467a-b762-fbb722748016.json
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/
5 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 18 Apr 2024 14:21:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
77275
content-md5
Uj3iBUKm1Vl2g2NHq67V+w==
content-length
1792
x-ms-lease-status
unlocked
last-modified
Thu, 28 Dec 2023 19:56:54 GMT
server
cloudflare
etag
0x8DC07DF23DF5130
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
67257c4e-101e-0033-60c8-396628000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
87654d0608b69066-FRA
expires
Fri, 19 Apr 2024 14:21:22 GMT
truncated
/
71 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
cve-2023-1389-hero.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/
276 KB
277 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-heros/cve-2023-1389-hero.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
c3dadb2e90b16ee647dff7555c9c7e58f7cb28952b32afbc19e12b98b4e24698
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Tue, 16 Apr 2024 15:20:36 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
169952
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
282165
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:50:07 GMT
Server
Apache
ETag
"44e35-615e91066cdc0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
k-7JXpRMe4lewuf69W9YpRsHUqMP5qYo6jNFpQ68hcTTSPNd32FZpg==
ddos-botnets-zyxel-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/
46 KB
47 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-heros/ddos-botnets-zyxel-thumbnail.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
4e276f2c1023e029c87b381441a5591e8e1a47661b432f506cbe2eb8e4cdac40
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Tue, 16 Apr 2024 17:21:05 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
162017
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
46825
X-XSS-Protection
1; mode=block
Last-Modified
Mon, 17 Jul 2023 22:41:46 GMT
Server
Apache
ETag
"b6e9-600b680d8be80"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
PtJlxCYnIQz1cfN6TVyoZm3tSkFurCV4TUEILM0Rubl9VhjIaAbQeQ==
trickbot01.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ive_got_trickbot_under_my_screen/
17 KB
19 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/ive_got_trickbot_under_my_screen/trickbot01.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
5410fc74cae3b6ca1b25f8cf313a6d95522f5cb27cde22eea917d8bc75f8cfb0
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Thu, 18 Apr 2024 14:17:57 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
20653297
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
17903
X-XSS-Protection
1; mode=block
Last-Modified
Wed, 23 May 2018 02:45:42 GMT
Server
Apache
ETag
"45ef-56cd687e0a180"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
GvqTzoCW6vjbbgZT_1SVWcqO5JNVesiVlCaJiyHsArxAn4vfEx-9mw==
botnet_thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/a-wicked-family-of-bots/
130 KB
131 KB
Image
General
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/a-wicked-family-of-bots/botnet_thumbnail.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
89aa0dff49a99d92471a3ed9d61c3da20692b2f228f206f36eeefb89ddec36e6
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Thu, 18 Apr 2024 14:11:44 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
20654394
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
133011
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 15 May 2018 16:47:19 GMT
Server
Apache
ETag
"20793-56c415b00b3c0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
3VYY1JGXaY_5nI0bXE09WeZWU2dXa9fuSXQAj6teYaPxk0L76MrNpQ==
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/
37 KB
38 KB
Font
General
Full URL
https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.dd0a483149c256850fa49d2e21abf149.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.dd0a483149c256850fa49d2e21abf149.css
Origin
https://www.fortinet.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Thu, 04 Apr 2024 21:20:21 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
1184627
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
37716
X-XSS-Protection
1; mode=block
Last-Modified
Wed, 18 May 2022 21:11:25 GMT
Server
Apache
ETag
"9354-5df4fb32c7940"
X-Frame-Options
SAMEORIGIN
Content-Type
application/octet-stream
Cache-Control
max-age=2000000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
Mf_KTaiDLcZuyqZnBLI09QhlGKipw2TExw3L9YZ78JCpG6y2SpzwvA==
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
68 B
306 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
accept
application/json
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 14:21:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
87654d06acf19738-FRA
access-control-allow-headers
Content-Type
fig00-tp-link-telemetry.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_69113330.img.png/1712939390464/
31 KB
32 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_69113330.img.png/1712939390464/fig00-tp-link-telemetry.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
64dac8f04830acaebd720fb02122359e25cf2b1cdcc46720dcd61d95ad4d57e3
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Wed, 17 Apr 2024 23:50:51 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122536
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
31644
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:29:50 GMT
Server
Apache
ETag
"7b9c-615e8c7dcdb80"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
vYG11npfwrEhlePoARc1Sv_wArwqb4Ek0jH8lJpBr__e3pYbPNjIKw==
fig01-ips-telemetry.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1712939407501/
61 KB
63 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1712939407501/fig01-ips-telemetry.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
08747f89f98e1ff50d148cf53bf84e4d7e93af152a5cf717bbf550f5ac51a8c9
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:51 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122687
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
62672
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:30:07 GMT
Server
Apache
ETag
"f4d0-615e8c8e041c0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
kuE7fkSlI0V03OW1srRCid2dPJYeu4mLyOX4wBMESatXrqD-pbBs0g==
fig02-vulnerability-poc.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1994044765.img.png/1712939425917/
42 KB
44 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1994044765.img.png/1712939425917/fig02-vulnerability-poc.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
95f15e2deeeb04d8b7c3c0a957998aded40c50275952eed22e5fc0cfd38e87f9
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:51 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122547
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
43284
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:30:25 GMT
Server
Apache
ETag
"a914-615e8c9f2ea40"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
IPijxAlFfv5DCfNOY97ZVUZgi9iUeWlptCA9LuuQ8Km_9ZirGDNVjQ==
truncated
/
42 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
fig03-exploit-packet.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1401988846.img.png/1712939448347/
25 KB
26 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1401988846.img.png/1712939448347/fig03-exploit-packet.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
1c10c4880c29e77ad8388fe16efa9d9846d6b3a3e812cc6701bdca063a8cdf4f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:52 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122547
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
25326
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:30:48 GMT
Server
Apache
ETag
"62ee-615e8cb51de00"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
Svw4k7IvIbLfwnsNmidKRoc_NZdQxdNZGq3RcOUIgGJO_55NNgHq8w==
fig04-script-file-exec-sh.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_872533556.img.png/1712939464341/
70 KB
71 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_872533556.img.png/1712939464341/fig04-script-file-exec-sh.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
35813b4fb8c84b8948e145fbfc0192dd96448d795f69bf9fcc6dec1f25a1fab8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Wed, 17 Apr 2024 23:50:52 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122535
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
71629
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:31:04 GMT
Server
Apache
ETag
"117cd-615e8cc460200"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
9646fN8WpcXH2eGfsa14-gonRHSMTUYCBrNkHTGm9uadVYVW0HaFQw==
fig05-assembly-code-for-user-creation.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1731474421.img.png/1712939483280/
126 KB
127 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1731474421.img.png/1712939483280/fig05-assembly-code-for-user-creation.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
4bd09acb9b108f53cef52f648de744c01148983eaeae12559bab6dc8335e1cf8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Wed, 17 Apr 2024 23:50:52 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122686
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
129049
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:31:23 GMT
Server
Apache
ETag
"1f819-615e8cd67ecc0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
yysCBscvHFAzLtLwnrU7Xi49ML21hwpxqH3YkNctKPbt6k41Yc2vUw==
fig06-malware-execution.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_835866544.img.png/1712939500273/
87 KB
88 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_835866544.img.png/1712939500273/fig06-malware-execution.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
6eb23e155b22c8b86f64eefaba84b99220b1bfbbf04495473fb0f16e3416f76c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:52 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122547
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
88787
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:31:40 GMT
Server
Apache
ETag
"15ad3-615e8ce6b5300"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
VeJtELuj4KBNWsWy-DfdGCz8MvEpTiKc40f-QKauTuasSw4j2wIU1Q==
fig07-established-c2-session-packet.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1504075610.img.png/1712939520627/
125 KB
126 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1504075610.img.png/1712939520627/fig07-established-c2-session-packet.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
60bf56504d4e2e56b08ada352c5c062b8d6cf00b04d6c62404fd512bb2e91104
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:52 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122546
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
127956
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:32:00 GMT
Server
Apache
ETag
"1f3d4-615e8cf9c8000"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
DwrQArNTayMyH_wwC5eFHnrzJ-jBoqfaP0HoJGFa2NxFE3t448q7Bg==
fig08-established-c2-session-packet-with-credential.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_429462719.img.png/1712939537600/
102 KB
104 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_429462719.img.png/1712939537600/fig08-established-c2-session-packet-with-credential.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
26e16b278cc61a8fe55fba9b3463d2d78f76ddd214b58bc8a3a460c61d902015
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Wed, 17 Apr 2024 23:50:52 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122685
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
104783
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:32:17 GMT
Server
Apache
ETag
"1994f-615e8d09fe640"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
zGDS0635R3UqG6zmPKkN_JXRW7yb58LFt3c2V8qF_75c8d5obJqJZQ==
fig09-exploit-packet.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_618234054.img.png/1712939550759/
29 KB
30 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_618234054.img.png/1712939550759/fig09-exploit-packet.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
efef3552335e2e1e9b262cabdd7a88bb550bb92fad1fcac95249ed1dcbe3da2b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Wed, 17 Apr 2024 23:50:52 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122684
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
29318
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:32:30 GMT
Server
Apache
ETag
"7286-615e8d1664380"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
oD612902RGyV9NdFtWC2AY1XEVqqUJIanTf-zkpYMJPbBoC3F-CxiA==
fig10-script-file-bins-sh.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_578031186.img.png/1712939568856/
60 KB
61 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_578031186.img.png/1712939568856/fig10-script-file-bins-sh.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
d6cc21632262335643ecd27988eafc6993965ff7a83a1b545f53e9bc2c62612d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Wed, 17 Apr 2024 23:50:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122683
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
61161
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:32:48 GMT
Server
Apache
ETag
"eee9-615e8d278ec00"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
BT9I5FxYIH-CHQHMthrcuJbefmCgliwEoJ1hp7X5_Szms8BxAO8hLA==
fig11-initial-connection-message-concatenation.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_741222763.img.png/1712939586806/
32 KB
33 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_741222763.img.png/1712939586806/fig11-initial-connection-message-concatenation.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
2558b9d10b1354ce177fb01830aea3b3888459154a55cdb832822985c55d782b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122546
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
32504
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:33:06 GMT
Server
Apache
ETag
"7ef8-615e8d38b9480"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
9ejb392kgUDWlUZQUfWTSBwoiDIRDZWmFJGe-fdh_hTuoVmrQJ_h7g==
fig12-c2-server-connection.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_806509797.img.png/1712939608532/
165 KB
166 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_806509797.img.png/1712939608532/fig12-c2-server-connection.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
07a044e99eff11fa07298e17450d9aee02d0bffa26ad349de490b0e000462cfa
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122545
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
168891
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:33:28 GMT
Server
Apache
ETag
"293bb-615e8d4db4600"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
jphJxV0rQLTrCgyFu0lA9WIqiTomPTqhhFY8npwx6lRphM-twSdxHw==
fig13-hand-coded-commands.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1187360097.img.png/1712939624947/
40 KB
41 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1187360097.img.png/1712939624947/fig13-hand-coded-commands.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
f9ebb1b0e05107ac34209684a478280545dcbde9098431633af7aa8fad40ad11
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122545
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
40619
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:33:44 GMT
Server
Apache
ETag
"9eab-615e8d5cf6a00"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
NAQa_3MP67nhhWiLJmxuHvqa7_Y2Qi_1OJPUBy0kGsLGdi9sHD1vuA==
fig14-exploit-packet.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1706601208.img.png/1712939639369/
20 KB
21 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1706601208.img.png/1712939639369/fig14-exploit-packet.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
8b022c9e58db59d1196f8f3d9e608833e718154126b5e5d36a09bd6adf47d968
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122545
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
20208
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:33:59 GMT
Server
Apache
ETag
"4ef0-615e8d6b44bc0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
5CxJ6Qa6e46k85yZqODwztINc8m_wJXdZi7EvzBFS7I8RSB7UrKSYg==
fig15-script-file-1-sh.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_925191786.img.png/1712939653956/
60 KB
61 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_925191786.img.png/1712939653956/fig15-script-file-1-sh.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
b08982b7c938d89501f9a7e52586818239945fd0c239e5165c89ccec0572ff67
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122545
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
61557
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:34:13 GMT
Server
Apache
ETag
"f075-615e8d789eb40"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
6VpN5XPIgpp2YKS47kOzfvmJ3m2HP-H8RG5ONR5N6MTwgy60bGtR1Q==
fig16-moobot-c2-session.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_522897434.img.png/1712939669144/
173 KB
175 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_522897434.img.png/1712939669144/fig16-moobot-c2-session.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
b8b36892ed4655a3294b6511e272d2f27850be2427d273473ab7e897541f5a81
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Wed, 17 Apr 2024 23:50:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122680
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
177326
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:34:29 GMT
Server
Apache
ETag
"2b4ae-615e8d87e0f40"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
5rIFeWQlUVoUmUPMEdwz6eAP_NI639rUEpZgEPJSskeyLC1ir-QjUg==
fig17-assembly-code-for-ddos-method.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_58423568.img.png/1712939685897/
155 KB
156 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_58423568.img.png/1712939685897/fig17-assembly-code-for-ddos-method.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
c2aa45e220079c7124c5959b772785d4988ea2872a4335b861200bc7911473ae
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122544
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
158559
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:34:45 GMT
Server
Apache
ETag
"26b5f-615e8d9723340"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
Qlu79CtJr6XIv0wu1gJyvfYONtXquDjzvC1UGfFNSbW4u6c9PllH7A==
fig18-exploit-packet.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1880189608.img.png/1712939699911/
64 KB
66 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1880189608.img.png/1712939699911/fig18-exploit-packet.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
6af2389de7a4b0b17a14e15134de454df421b6fcd1237b6e0d71c2c218d8a0a0
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Wed, 17 Apr 2024 23:50:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122680
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
65733
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:34:59 GMT
Server
Apache
ETag
"100c5-615e8da47d2c0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
LasP_EP8KMFr7kPqYFUgoCYR2NQd8HbTWc3rB1fIIhVGxORYwjy__g==
fig19-script-file-tenda-sh.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_702217218.img.png/1712939803574/
59 KB
60 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_702217218.img.png/1712939803574/fig19-script-file-tenda-sh.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
95d83fec94f60f7d8743e332553dbad0279a7bddf358488651c4374f20c460aa
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:54 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122545
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
60189
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:36:43 GMT
Server
Apache
ETag
"eb1d-615e8e07abcc0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
RHJV50B0sHJNhqxqcV5NIbFl9U6SWaMAx8zmEJQn17yjrJ8B3VFbXQ==
fig20-upx-packed.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1418577685.img.png/1712939817232/
162 KB
164 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1418577685.img.png/1712939817232/fig20-upx-packed.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
d7c04d764a15127750819e45ec021f249ac373432d035ae719d5a41dd67e7a3a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:53 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122543
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
166075
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:36:57 GMT
Server
Apache
ETag
"288bb-615e8e1505c40"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
g-YU7u2JKhRGwxs7JLnQdfdshSitjcYpUlaRS0H1ZwPEQ-q2T3qMqw==
fig21-packet-analysis-tool-list.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1199483276.img.png/1712939835861/
110 KB
112 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1199483276.img.png/1712939835861/fig21-packet-analysis-tool-list.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
9df2ee7eaeef69999ba767745e219dae594fce3d48de1a0a246e539dadfa7143
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:54 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122544
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
112851
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:37:15 GMT
Server
Apache
ETag
"1b8d3-615e8e26304c0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
KgR0TdASn3zcdTZtpfNn92bhjHgY3z7lx6D6BrKV2mh614U3rKswSQ==
fig22-c2-command-packets.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_906379190.img.png/1712939853456/
106 KB
107 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_906379190.img.png/1712939853456/fig22-c2-command-packets.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
f7d402bed5a13e8ae4b5c1a4946886028d0cf8f9137371722e9a583efedb9318
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:54 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122544
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
108684
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:37:33 GMT
Server
Apache
ETag
"1a88c-615e8e375ad40"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
EnuYmdCy_-frkWtQj6VnoOpsK6s3Nyc-Cua2ibuGe8weMjonGyYGYg==
fig23-exploit-packet.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_764362924.img.png/1712939866014/
38 KB
40 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_764362924.img.png/1712939866014/fig23-exploit-packet.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
84fdeedacd07ff72ab8021baf28333d21502644196070658648495ba1ef315ea
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:54 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122544
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
39167
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:37:46 GMT
Server
Apache
ETag
"98ff-615e8e43c0a80"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
q5SqX3EoBc58S8KmyENe7AvkDURNF6JeSQ-WWIQsUy37UZkN1TxMZg==
fig24-script-file-shk.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1974353489.img.png/1712939880657/
31 KB
32 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1974353489.img.png/1712939880657/fig24-script-file-shk.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
d33d0812716fe1d724696b3e682b57663dd0f911a02f0b7dac0129da83926afc
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:54 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122544
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
31631
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:38:00 GMT
Server
Apache
ETag
"7b8f-615e8e511aa00"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
T9chPZ9KnPa83jH7htKYtg4zHeTnkOVy15ZP8HHr3XNiqDhQ2UMVKg==
fig25-hard-coded-username-password-list.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1912893580.img.png/1712939898456/
269 KB
271 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1912893580.img.png/1712939898456/fig25-hard-coded-username-password-list.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
09330c7407ed683aa366676041a62c322ead662c74c302069c97c67a67cf34ba
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:54 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122544
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
275861
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:38:18 GMT
Server
Apache
ETag
"43595-615e8e6245280"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
bHx07zU8sWJB1FH-lUM3vxXQUHmhxGu22fN1svdlcsDjkx73c3viug==
fig26-c2-command-packets.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_925027603.img.png/1712939912492/
71 KB
72 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_925027603.img.png/1712939912492/fig26-c2-command-packets.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
e27e2760b87203e8e5bff77e600b469812ffcdce30b73f17778aaf626b50ec7d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:54 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122544
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
72328
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:38:32 GMT
Server
Apache
ETag
"11a88-615e8e6f9f200"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
HWAUGZxwg9envKgv-g6EfePt0ni2alWWnTmaruOXRy1maElelaFuEw==
fig27-exploit-packet.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_784346424.img.png/1712939926470/
58 KB
60 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_784346424.img.png/1712939926470/fig27-exploit-packet.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
8b25ad6007e20d735fe36107617b178b37b4148ebe53dfb8de6d4637b0e8f927
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:54 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122543
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
59818
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:38:46 GMT
Server
Apache
ETag
"e9aa-615e8e7cf9180"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
9syjvPv-vZXy-8bc_gySFXQkSIAMppVSM9QVPVw0Os-AMPvanrQvrQ==
fig28-script-file-jack5tr-sh.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1326466419.img.png/1712939940424/
129 KB
131 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1326466419.img.png/1712939940424/fig28-script-file-jack5tr-sh.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
3e3214d6df72f794f72677a8e4b8e79e521adfe6f75068d4d314c4b9592da57c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:55 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122543
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
132411
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:39:00 GMT
Server
Apache
ETag
"2053b-615e8e8a53100"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
57tZzWliDIZNCjBlcRLjiRvrDgXCMFB4u2tnxPz-K7JnXwQHK1-l7Q==
fig29-c2-session.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1149565179.img.png/1712939956765/
139 KB
141 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1149565179.img.png/1712939956765/fig29-c2-session.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
ffb378d075221a3abdcb5b63e4ce1746a76e089a80d0a0775c6acb9271a5b17a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:55 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122543
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
142772
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:39:16 GMT
Server
Apache
ETag
"22db4-615e8e9995500"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
Z06vA2lMVrsa_2XrNbtjF2fd2xHqlsnSo0nIaQ9HOFNmyU9EHBORkA==
fig30-check-process.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_81153327.img.png/1712939971328/
122 KB
123 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_81153327.img.png/1712939971328/fig30-check-process.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
df631c149119f5c4b5c8757af98193eb60586dd56a4cef9abd9d34caa15f4b1d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:55 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122543
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
124557
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:39:31 GMT
Server
Apache
ETag
"1e68d-615e8ea7e36c0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
z80jk2q81WGCmwKVWoVcVhrivyvIu8RHLNbEzLPJPk5sFR0_0QRCew==
fig31-condi-attacking-methods.png
www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1332901227.img.png/1712939985115/
95 KB
97 KB
Image
General
Full URL
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread/_jcr_content/root/responsivegrid/table_content/par/image_1332901227.img.png/1712939985115/fig31-condi-attacking-methods.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
325635bd558fb11a68f334ac7a5098780b88db589b783ddfc9d259dc5be30cab
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Wed, 17 Apr 2024 23:50:55 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
122543
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
97667
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Apr 2024 16:39:45 GMT
Server
Apache
ETag
"17d83-615e8eb53d640"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
1iFEXFYh650bspHMS7bOE6BrkOe8_5cpk9myYWEUh0o8dHJGw0cqgw==
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.10.0/
356 KB
78 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 18 Apr 2024 14:21:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Bh9exWOPGIwRshWljrtlEw==
age
73200
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
79698
x-ms-lease-status
unlocked
last-modified
Thu, 03 Dec 2020 02:43:00 GMT
server
cloudflare
etag
0x8D89735260901BC
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
196e3d49-701e-0078-0644-149a7b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
87654d07d9c01e31-FRA
en.json
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/4ee482d4-0cd8-4c59-918a-90483d5b8131/
100 KB
24 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/4ee482d4-0cd8-4c59-918a-90483d5b8131/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
46ef912a5bf1fec350dc9d14102bcf1965471f16a57a890bdc5fc06bc4404370
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 18 Apr 2024 14:21:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
75424
content-md5
0twb7zWjuAt4bYR0sykmNQ==
content-length
24175
x-ms-lease-status
unlocked
last-modified
Thu, 28 Dec 2023 19:57:10 GMT
server
cloudflare
etag
0x8DC07DF2D729AA1
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
63201da5-e01e-006a-57c8-39e1ab000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
87654d085b229066-FRA
expires
Fri, 19 Apr 2024 14:21:22 GMT
favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/
318 B
2 KB
Other
General
Full URL
https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Fri, 05 Apr 2024 21:22:20 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
1184546
Connection
keep-alive
Content-Length
133
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 22 Feb 2018 05:17:28 GMT
Server
Apache
ETag
"13e-565c628eb6a00-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
image/vnd.microsoft.icon
Cache-Control
max-age=2000000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
8iVEjDxgxxrr7b1kpcef2JQd2HnHSOjWD0D0mgFVNTPSoYuaumpTsw==
otCenterRounded.json
cdn.cookielaw.org/scripttemplates/6.10.0/assets/
9 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otCenterRounded.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 18 Apr 2024 14:21:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
SH1nUCPouc1JVrHnvxpQbg==
age
66472
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2857
x-ms-lease-status
unlocked
last-modified
Thu, 03 Dec 2020 02:42:51 GMT
server
cloudflare
etag
0x8D89735210A49EB
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
df6352b5-e01e-0018-22d2-21e6e4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
87654d08ab6e9066-FRA
otPcTab.json
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/
45 KB
12 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 18 Apr 2024 14:21:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
zNsRoM1FEmsEgJoYMCNTng==
age
81327
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
11755
x-ms-lease-status
unlocked
last-modified
Thu, 03 Dec 2020 02:42:53 GMT
server
cloudflare
etag
0x8D897352245C4EA
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
77f313b5-301e-0034-7eb4-210a4b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
87654d08ab729066-FRA
launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
assets.adobedtm.com/
493 KB
120 KB
Script
General
Full URL
https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:983::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
265addccb9e3e9a5c93c77c255bbd24988b55d86b95b8b57bb63b99af79e1707

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 14:21:23 GMT
content-encoding
gzip
last-modified
Tue, 09 Apr 2024 18:14:40 GMT
server
AkamaiNetStorage
etag
"9bb24d853a4fe21d3782364a2ed8abfb:1712686479.901115"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
122084
expires
Thu, 18 Apr 2024 15:21:23 GMT
AppMeasurement.min.js
assets.adobedtm.com/extensions/EPc7341b33570d4c988798fc9f0093d4b2/
35 KB
13 KB
Script
General
Full URL
https://assets.adobedtm.com/extensions/EPc7341b33570d4c988798fc9f0093d4b2/AppMeasurement.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:983::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
f012c00d43164a4de843ae80abefe500f8497e1123d11c965cd3b40600fe9720

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 14:21:23 GMT
content-encoding
gzip
last-modified
Mon, 04 Mar 2024 18:51:30 GMT
server
AkamaiNetStorage
etag
"964f8cb588092ac645368e7307eb73ac:1709578290.803919"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
12938
expires
Thu, 18 Apr 2024 15:21:23 GMT
AppMeasurement_Module_ActivityMap.min.js
assets.adobedtm.com/extensions/EPc7341b33570d4c988798fc9f0093d4b2/
3 KB
2 KB
Script
General
Full URL
https://assets.adobedtm.com/extensions/EPc7341b33570d4c988798fc9f0093d4b2/AppMeasurement_Module_ActivityMap.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:983::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
b90b775b65c2623322caaa52d7acf6af709ca59bdd475a54043b6308d91828c4

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 14:21:23 GMT
content-encoding
gzip
last-modified
Mon, 04 Mar 2024 18:51:31 GMT
server
AkamaiNetStorage
etag
"9cf185793291692f744c78c75da01dd8:1709578291.795602"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
1599
expires
Thu, 18 Apr 2024 15:21:23 GMT
6si.min.js
j.6sc.co/
65 KB
18 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.75.185 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-75-185.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
df4d1ff8adb72502d1b262d0a8af4c3c902ff5e37e442861f5a9fed51d75d18f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 18 Apr 2024 14:21:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 09 Apr 2024 21:38:47 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"6615b567-102f4"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
17825
expires
Thu, 18 Apr 2024 14:21:23 GMT
RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/cf461c22b737/
358 B
485 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/cf461c22b737/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:983::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
bcd1609a23b21dc2eb197f65a68b5638c10976fac901e8473039373494340adc

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 14:21:23 GMT
content-encoding
gzip
last-modified
Tue, 09 Apr 2024 18:14:41 GMT
server
AkamaiNetStorage
etag
"70cd3e845a29ecaa6d0efebd79d9b2cd:1712686481.868236"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
229
expires
Thu, 18 Apr 2024 15:21:23 GMT
RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/cf461c22b737/
2 KB
981 B
Script
General
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/cf461c22b737/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:983::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
3c3d94c0b99e5b782da0db26f5ebee43540ed810e443f567fe8b79b362d64394

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 14:21:23 GMT
content-encoding
gzip
last-modified
Tue, 09 Apr 2024 18:14:41 GMT
server
AkamaiNetStorage
etag
"70cd3e845a29ecaa6d0efebd79d9b2cd:1712686481.868236"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
724
expires
Thu, 18 Apr 2024 15:21:23 GMT
/
c.6sc.co/
7 B
194 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.75.185 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-75-185.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 14:21:23 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.fortinet.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
14 B
300 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
608809605af2e55d53fb2fba4aea30c6f5303560206b4cc918be70c3c4823411

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 18 Apr 2024 14:21:23 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:5a::5
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1713450083472_34603374_226786780_19_838_6_19_219";dur=1
content-length
14
expires
Thu, 18 Apr 2024 14:21:23 GMT
optOutStatus
dpm.demdex.net/
41 B
542 B
XHR
General
Full URL
https://dpm.demdex.net/optOutStatus?d_visid_ver=5.5.0&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1713450083517
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
176.34.140.246 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-176-34-140-246.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e5873dbdaa376d924cfa4b2ba4b1622d4e6e483866e2b7bc24ef3007ff5960e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
https://www.fortinet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

dcs
dcs-prod-irl1-1-v060-03a0364c5.edge-irl1.demdex.com 2 ms
pragma
no-cache
date
Thu, 18 Apr 2024 14:21:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-tid
hu6EHXEpSDk=
vary
Origin
content-type
application/json;charset=utf-8
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials
true
content-length
60
expires
Thu, 01 Jan 1970 00:00:00 UTC
details
epsilon.6sense.com/v3/company/
725 B
708 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software
nginx /
Resource Hash
d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
Authorization
Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
X-6s-CustomID
WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer
https://www.fortinet.com/
sec-ch-ua-platform
"Win32"

Response headers

x-trace-id
5459970232445700872
date
Thu, 18 Apr 2024 14:21:24 GMT
content-encoding
gzip
server
nginx
vary
Origin, Accept-Encoding
content-type
application/json
x-6si-region
eu-central-1a
access-control-allow-origin
https://www.fortinet.com
access-control-expose-headers
X-6si-Region
access-control-allow-credentials
true
timing-allow-origin
https://6sense.com, https://www.ssga.com
content-length
387
details
epsilon.6sense.com/v3/company/
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://www.fortinet.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.fortinet.com
access-control-expose-headers
X-6si-Region
access-control-max-age
1800
date
Thu, 18 Apr 2024 14:21:24 GMT
server
nginx
timing-allow-origin
https://6sense.com, https://www.ssga.com
x-6si-region
eu-central-1a
x-trace-id
8655982216225693016
s26351098886453
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.26.0-LDQM/
Redirect Chain
  • https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.26.0-LDQM/s26351098886453?AQB=1&ndh=1&pf=1&t=18%2F3%2F2024%2016%3A21%3A24%204%20-120&fid=578043B96BA009B9-0D8B876F5B627889&ce=UTF-8&pa...
  • https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.26.0-LDQM/s26351098886453?AQB=1&pccr=true&vidn=331096323EE81DE8-40001AFEE219300E&ndh=1&pf=1&t=18%2F3%2F2024%2016%3A21%3A24%204%20-120&...
43 B
248 B
Image
General
Full URL
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.26.0-LDQM/s26351098886453?AQB=1&pccr=true&vidn=331096323EE81DE8-40001AFEE219300E&ndh=1&pf=1&t=18%2F3%2F2024%2016%3A21%3A24%204%20-120&fid=578043B96BA009B9-0D8B876F5B627889&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
Protocol
H2
Server
63.140.62.222 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
ip-63-140-62-222.data.adobedc.net
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Apr 2024 14:21:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Fri, 19 Apr 2024 14:21:24 GMT
server
jag
etag
3679606037150302208-4618677425293523784
vary
*
p3p
CP="This is not a P3P policy"
access-control-allow-origin
*
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-length
43
x-xss-protection
1; mode=block
expires
Wed, 17 Apr 2024 14:21:24 GMT

Redirect headers

pragma
no-cache
date
Thu, 18 Apr 2024 14:21:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Fri, 19 Apr 2024 14:21:24 GMT
server
jag
vary
Origin
p3p
CP="This is not a P3P policy"
access-control-allow-origin
*
location
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.26.0-LDQM/s26351098886453?AQB=1&pccr=true&vidn=331096323EE81DE8-40001AFEE219300E&ndh=1&pf=1&t=18%2F3%2F2024%2016%3A21%3A24%204%20-120&fid=578043B96BA009B9-0D8B876F5B627889&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
content-type
text/plain;charset=utf-8
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-length
0
x-xss-protection
1; mode=block
expires
Wed, 17 Apr 2024 14:21:24 GMT

Verdicts & Comments Add Verdict or Comment

68 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| OneTrustStub function| OptanonWrapper object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| setImmediate function| clearImmediate function| $ function| jQuery string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| Optanon object| OneTrust object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in number| timer_e object| _6si function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq function| AppMeasurement_Module_ActivityMap object| Sixsct object| t function| liberatedGetOptOut boolean| _storagePopulated object| s_i_fortinetincproduction object| targetGlobalSettings

11 Cookies

Domain/Path Name / Value
www.fortinet.com/ Name: cookiesession1
Value: 678A3E13F6D39B2C2ED72B204234A992
www.fortinet.com/ Name: AWSALB
Value: yQ/aoiFowjTExmKLgNwcKTKa1cOFJqvN4RzBu8/sPA70xWvZEBuQvj77C4TNUAwayVjk+VyD9JdF4z/Ixnd+Rz6Vtnz+TGpBI9sCtBD8ZYPwrp/RlOZH1cbVAeaZ8cOaQSFoPM3axhpPEZDOvQQH3dw/GmKoZVZ7zwZBficiydDwozqCUJDi5d//Me5on34iYbDrSFUjib14lO8n95QRWw==
www.fortinet.com/ Name: AWSALBCORS
Value: yQ/aoiFowjTExmKLgNwcKZmSzE++dLQ6WjVksvvBPvJ/x7wvUesj6Cs0eEeu3ahBVxDtuFabc1F8Bb1mq/WtGntRqLd75iQbKufY/6sy6X5mdcqaEJeyUI6oJWWSbtutoyA8+OSDy89J5HHkiMv9P6KFvz9U8XejddPk0GYfrnCMC8EZ4sZVJEB+LLXlIih2WmOnwwFRejPVo2Vm4N8MHg==
.fortinet.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Thu+Apr+18+2024+16%3A21%3A22+GMT%2B0200+(Mitteleurop%C3%A4ische+Sommerzeit)&version=6.10.0&hosts=&consentId=57bc00b3-efa8-4836-ac59-d262d3a5ba33&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
www.fortinet.com/ Name: aa_cc
Value: DE
www.fortinet.com/ Name: aa_cn
Value: DE
.fortinet.com/ Name: s_fid
Value: 578043B96BA009B9-0D8B876F5B627889
.fortinet.com/ Name: gpv_pn
Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fbotnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
.fortinet.com/ Name: s_getNewRepeat
Value: 1713450084292-New
.fortinet.com/ Name: s_cc
Value: true
.fortinet.com/ Name: s_vi
Value: [CS]v1|331096323EE81DE8-40001AFEE219300E[CE]

2 Console Messages

Source Level URL
Text
javascript warning URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Message:
The resource https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
Message:
The resource https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
c.6sc.co
cdn.cookielaw.org
dpm.demdex.net
epsilon.6sense.com
geolocation.onetrust.com
ipv6.6sc.co
j.6sc.co
metrics.fortinet.com
www.fortinet.com
13.248.142.121
176.34.140.246
2606:4700:4400::6812:2089
2606:4700::6813:b134
2a02:26f0:480:983::1e80
2a02:26f0:7100::210:172
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
63.140.62.222
95.101.75.185
07a044e99eff11fa07298e17450d9aee02d0bffa26ad349de490b0e000462cfa
08747f89f98e1ff50d148cf53bf84e4d7e93af152a5cf717bbf550f5ac51a8c9
09330c7407ed683aa366676041a62c322ead662c74c302069c97c67a67cf34ba
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
1c10c4880c29e77ad8388fe16efa9d9846d6b3a3e812cc6701bdca063a8cdf4f
2558b9d10b1354ce177fb01830aea3b3888459154a55cdb832822985c55d782b
265addccb9e3e9a5c93c77c255bbd24988b55d86b95b8b57bb63b99af79e1707
26e16b278cc61a8fe55fba9b3463d2d78f76ddd214b58bc8a3a460c61d902015
325635bd558fb11a68f334ac7a5098780b88db589b783ddfc9d259dc5be30cab
35813b4fb8c84b8948e145fbfc0192dd96448d795f69bf9fcc6dec1f25a1fab8
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
3c3d94c0b99e5b782da0db26f5ebee43540ed810e443f567fe8b79b362d64394
3e3214d6df72f794f72677a8e4b8e79e521adfe6f75068d4d314c4b9592da57c
452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7
46ef912a5bf1fec350dc9d14102bcf1965471f16a57a890bdc5fc06bc4404370
4bd09acb9b108f53cef52f648de744c01148983eaeae12559bab6dc8335e1cf8
4e276f2c1023e029c87b381441a5591e8e1a47661b432f506cbe2eb8e4cdac40
5410fc74cae3b6ca1b25f8cf313a6d95522f5cb27cde22eea917d8bc75f8cfb0
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
608809605af2e55d53fb2fba4aea30c6f5303560206b4cc918be70c3c4823411
60bf56504d4e2e56b08ada352c5c062b8d6cf00b04d6c62404fd512bb2e91104
64dac8f04830acaebd720fb02122359e25cf2b1cdcc46720dcd61d95ad4d57e3
6af2389de7a4b0b17a14e15134de454df421b6fcd1237b6e0d71c2c218d8a0a0
6eb23e155b22c8b86f64eefaba84b99220b1bfbbf04495473fb0f16e3416f76c
6f08699117c1f15f6d35e7b4380d12d18a1881f075e177b5853b1017a3307544
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
84fdeedacd07ff72ab8021baf28333d21502644196070658648495ba1ef315ea
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
89aa0dff49a99d92471a3ed9d61c3da20692b2f228f206f36eeefb89ddec36e6
8b022c9e58db59d1196f8f3d9e608833e718154126b5e5d36a09bd6adf47d968
8b25ad6007e20d735fe36107617b178b37b4148ebe53dfb8de6d4637b0e8f927
95d83fec94f60f7d8743e332553dbad0279a7bddf358488651c4374f20c460aa
95f15e2deeeb04d8b7c3c0a957998aded40c50275952eed22e5fc0cfd38e87f9
9df2ee7eaeef69999ba767745e219dae594fce3d48de1a0a246e539dadfa7143
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
b08982b7c938d89501f9a7e52586818239945fd0c239e5165c89ccec0572ff67
b8b36892ed4655a3294b6511e272d2f27850be2427d273473ab7e897541f5a81
b90b775b65c2623322caaa52d7acf6af709ca59bdd475a54043b6308d91828c4
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bcd1609a23b21dc2eb197f65a68b5638c10976fac901e8473039373494340adc
bf19e4cab46ebfd04a1438e21bc98c6f520c476918f71d44a96d2523fe0abec4
c2aa45e220079c7124c5959b772785d4988ea2872a4335b861200bc7911473ae
c3dadb2e90b16ee647dff7555c9c7e58f7cb28952b32afbc19e12b98b4e24698
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d33d0812716fe1d724696b3e682b57663dd0f911a02f0b7dac0129da83926afc
d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98
d6cc21632262335643ecd27988eafc6993965ff7a83a1b545f53e9bc2c62612d
d7c04d764a15127750819e45ec021f249ac373432d035ae719d5a41dd67e7a3a
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
df4d1ff8adb72502d1b262d0a8af4c3c902ff5e37e442861f5a9fed51d75d18f
df631c149119f5c4b5c8757af98193eb60586dd56a4cef9abd9d34caa15f4b1d
e27e2760b87203e8e5bff77e600b469812ffcdce30b73f17778aaf626b50ec7d
e5873dbdaa376d924cfa4b2ba4b1622d4e6e483866e2b7bc24ef3007ff5960e7
e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efef3552335e2e1e9b262cabdd7a88bb550bb92fad1fcac95249ed1dcbe3da2b
f012c00d43164a4de843ae80abefe500f8497e1123d11c965cd3b40600fe9720
f7d402bed5a13e8ae4b5c1a4946886028d0cf8f9137371722e9a583efedb9318
f95b62f026ed0d8161a753024fcd4e7c5f8677feb314645900ea53e1a832174b
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
f9ebb1b0e05107ac34209684a478280545dcbde9098431633af7aa8fad40ad11
fa943374519bbb0d7c9792c51165fbe3622f5b73e73f9cc5d08800be959d5fd7
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ffb378d075221a3abdcb5b63e4ce1746a76e089a80d0a0775c6acb9271a5b17a