www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1702:852f:d87f:6683:b05a Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Submission: On October 15 via api (October 15th 2024, 2:11:55 pm UTC) from IN — Scanned from US

Summary HTTP 235 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 74 IPs in 2 countries across 63 domains to perform 235 HTTP transactions. The main IP is 2600:1f18:1492:1702:852f:d87f:6683:b05a, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 120260.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 16th 2024. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
67	2600:1f18:149... 2600:1f18:1492:1702:852f:d87f:6683:b05a	14618 (AMAZON-AES) (AMAZON-AES)
6	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
23	2600:141b:1c0... 2600:141b:1c00:209a::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 4	18.209.0.122 18.209.0.122	14618 (AMAZON-AES) (AMAZON-AES)
1	44.209.251.198 44.209.251.198	14618 (AMAZON-AES) (AMAZON-AES)
1 1	34.194.162.5 34.194.162.5	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.39.150 63.140.39.150	14618 (AMAZON-AES) (AMAZON-AES)
4	104.19.148.8 104.19.148.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	23.34.59.26 23.34.59.26	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.51.57.192 23.51.57.192	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.86.110.8 34.86.110.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	2607:f8b0:400... 2607:f8b0:4006:81e::2008	15169 (GOOGLE) (GOOGLE)
2	64.202.112.191 64.202.112.191	23352 (SERVERCEN...) (SERVERCENTRAL)
1	2600:141b:1c0... 2600:141b:1c00:2e::17d1:48c5	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	99.83.231.3 99.83.231.3	16509 (AMAZON-02) (AMAZON-02)
2	3.135.83.200 3.135.83.200	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4006:81e::200e	15169 (GOOGLE) (GOOGLE)
2	2a02:6ea0:c45... 2a02:6ea0:c454::1	60068 (CDN77 _) (CDN77 _)
1 4	142.250.64.66 142.250.64.66	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4006:822::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.81.230 142.250.81.230	15169 (GOOGLE) (GOOGLE)
1	63.140.39.9 63.140.39.9	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700:310... 2606:4700:3108::ac42:2af8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1347	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.32.164.86 52.32.164.86	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:bdf::40 2620:1ec:bdf::40	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	74.121.140.211 74.121.140.211	30419 (PAEDAE-INC) (PAEDAE-INC)
2	142.250.80.104 142.250.80.104	15169 (GOOGLE) (GOOGLE)
3	142.250.65.228 142.250.65.228	15169 (GOOGLE) (GOOGLE)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
2	44.226.187.177 44.226.187.177	16509 (AMAZON-02) (AMAZON-02)
1	44.209.137.118 44.209.137.118	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.44.157 151.101.44.157	54113 (FASTLY) (FASTLY)
1	2600:141b:1c0... 2600:141b:1c00:6::17df:d120	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	34.196.140.205 34.196.140.205	14618 (AMAZON-AES) (AMAZON-AES)
2 3	68.67.179.164 68.67.179.164	29990 (ASN-APPNEX) (ASN-APPNEX)
3 5	68.67.181.211 68.67.181.211	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:251... 2600:9000:2512:3a00:12:dfa9:e200:93a1	16509 (AMAZON-02) (AMAZON-02)
19 22	35.194.66.159 35.194.66.159	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	69.194.240.13 69.194.240.13	26120 (RHYTHMONE) (RHYTHMONE)
1 2	35.71.139.29 35.71.139.29	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4264:4138:d6ea:f3b0:2f1c	14618 (AMAZON-AES) (AMAZON-AES)
3 4	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	108.138.128.14 108.138.128.14	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:26f... 2600:9000:26fa:5c00:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2600:9000:26f... 2600:9000:26fa:a400:1b:6b7d:2300:93a1	16509 (AMAZON-02) (AMAZON-02)
1	8.28.7.83 8.28.7.83	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	63.251.28.210 63.251.28.210	26558 (FREEWHEEL) (FREEWHEEL)
2 2	2600:1901:0:8... 2600:1901:0:8eee::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	23.105.12.120 23.105.12.120	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
1 2	34.200.65.202 34.200.65.202	14618 (AMAZON-AES) (AMAZON-AES)
1	34.193.229.172 34.193.229.172	14618 (AMAZON-AES) (AMAZON-AES)
1	184.50.205.247 184.50.205.247	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	44.215.158.120 44.215.158.120	14618 (AMAZON-AES) (AMAZON-AES)
1 2	52.6.142.3 52.6.142.3	14618 (AMAZON-AES) (AMAZON-AES)
3 3	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	107.178.254.65 107.178.254.65	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4 7	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	142.251.40.226 142.251.40.226	15169 (GOOGLE) (GOOGLE)
1 2	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	35.244.159.8 35.244.159.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
1	54.203.236.163 54.203.236.163	16509 (AMAZON-02) (AMAZON-02)
3	172.66.0.227 172.66.0.227	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	172.217.165.134 172.217.165.134	15169 (GOOGLE) (GOOGLE)
2	157.240.241.1 157.240.241.1	32934 (FACEBOOK) (FACEBOOK)
1	172.67.163.237 172.67.163.237	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	44.212.189.233 44.212.189.233	14618 (AMAZON-AES) (AMAZON-AES)
2 7	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.94.188.245 3.94.188.245	14618 (AMAZON-AES) (AMAZON-AES)
8 9	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
2 3	52.3.138.212 52.3.138.212	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	44.235.191.156 44.235.191.156	16509 (AMAZON-02) (AMAZON-02)
1	35.81.162.201 35.81.162.201	16509 (AMAZON-02) (AMAZON-02)
1	44.225.29.129 44.225.29.129	16509 (AMAZON-02) (AMAZON-02)
235	74

67 2600:1f18:1492:1702:852f:d87f:6683:b05a (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2600:141b:1c00:209a::1e80 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.209.0.122 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-209-0-122.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.209.251.198 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-209-251-198.compute-1.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.194.162.5 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-194-162-5.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.150 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-150.data.adobedc.net

fortinet.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.19.148.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 23.34.59.26 (Edison, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-34-59-26.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.51.57.192 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-51-57-192.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wave.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.86.110.8 (Washington, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.110.86.34.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:81e::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.202.112.191 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:2e::17d1:48c5 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.231.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.135.83.200 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-135-83-200.us-east-2.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81e::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:6ea0:c454::1 (New York, United States)

ASN60068 (CDN77 _, GB)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.64.66 (Plainview, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s30-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:822::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.81.230 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s74-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.9 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-9.data.adobedc.net

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:2af8 (United States)

ASN13335 (CLOUDFLARENET, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1347 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.32.164.86 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-164-86.us-west-2.compute.amazonaws.com

abm-tracking.demandscience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:bdf::40 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

tmp.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixels.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
webtracker.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.121.140.211 (Reston, United States)

ASN30419 (PAEDAE-INC, US)

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.80.104 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s36-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.65.228 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.226.187.177 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-226-187-177.us-west-2.compute.amazonaws.com

intentstream.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.209.137.118 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-209-137-118.compute-1.amazonaws.com

dx.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.44.157 (San Francisco, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:6::17df:d120 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.196.140.205 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-140-205.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.67.179.164 (North Bergen, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 68.67.181.211 (North Bergen, United States) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2512:3a00:12:dfa9:e200:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.inzynk.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 35.194.66.159 (Washington, United States) 19 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 159.66.194.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.194.240.13 (United States)

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.139.29 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4264:4138:d6ea:f3b0:2f1c (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.111.113.62 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.128.14 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-14.jfk50.r.cloudfront.net

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26fa:5c00:19:fc2c:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:26fa:a400:1b:6b7d:2300:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.251.28.210 (Secaucus, United States)

ASN26558 (FREEWHEEL, US)

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.105.12.120 (Manassas, United States) 1 redirects

ASN30633 (LEASEWEB-USA-WDC, US)

sync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.200.65.202 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-65-202.compute-1.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.193.229.172 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-193-229-172.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.50.205.247 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-50-205-247.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.215.158.120 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-215-158-120.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.6.142.3 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-142-3.compute-1.amazonaws.com

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.154.8 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.178.254.65 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.226 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.40.130 (Queens, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.203.236.163 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-236-163.us-west-2.compute.amazonaws.com

tracking.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.66.0.227 (United States)

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.165.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s70-in-f6.1e100.net

10104846.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.241.1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-lga3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.163.237 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.212.189.233 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-212-189-233.compute-1.amazonaws.com

44.212.189.233	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.117.77.79 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.94.188.245 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-94-188-245.compute-1.amazonaws.com

6033413.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 15.197.193.217 (Seattle, United States) 8 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.3.138.212 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-138-212.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.235.191.156 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-235-191-156.us-west-2.compute.amazonaws.com

px.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.81.162.201 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-81-162-201.us-west-2.compute.amazonaws.com

gs.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.225.29.129 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-225-29-129.us-west-2.compute.amazonaws.com

px.steelhousemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
68	fortinet.com www.fortinet.com — Cisco Umbrella Rank: 120260 metrics.fortinet.com — Cisco Umbrella Rank: 303802	5 MB
24	simpli.fi 19 redirects tag.simpli.fi — Cisco Umbrella Rank: 4957 i.simpli.fi — Cisco Umbrella Rank: 4183 um.simpli.fi — Cisco Umbrella Rank: 913	14 KB
23	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 430	152 KB
16	6sc.co j.6sc.co — Cisco Umbrella Rank: 5626 c.6sc.co — Cisco Umbrella Rank: 6951 ipv6.6sc.co — Cisco Umbrella Rank: 5794 b.6sc.co — Cisco Umbrella Rank: 3611 eps.6sc.co — Cisco Umbrella Rank: 11869	22 KB
13	doubleclick.net 4 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 td.doubleclick.net — Cisco Umbrella Rank: 192 ad.doubleclick.net — Cisco Umbrella Rank: 150 cm.g.doubleclick.net — Cisco Umbrella Rank: 283 10104846.fls.doubleclick.net — Cisco Umbrella Rank: 324916	7 KB
9	adsrvr.org 8 redirects match.adsrvr.org — Cisco Umbrella Rank: 373 insight.adsrvr.org — Cisco Umbrella Rank: 945	7 KB
8	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 www.linkedin.com — Cisco Umbrella Rank: 646 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	5 KB
8	adnxs.com 5 redirects secure.adnxs.com — Cisco Umbrella Rank: 479 ib.adnxs.com — Cisco Umbrella Rank: 267	9 KB
8	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	744 KB
7	ml314.com 2 redirects ml314.com — Cisco Umbrella Rank: 1614	14 KB
6	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2568 tracking.crazyegg.com — Cisco Umbrella Rank: 4786	41 KB
6	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	127 KB
5	outbrain.com amplify.outbrain.com — Cisco Umbrella Rank: 3182 tr.outbrain.com — Cisco Umbrella Rank: 3133 wave.outbrain.com — Cisco Umbrella Rank: 3153	10 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 243 fortinet.demdex.net — Cisco Umbrella Rank: 337765	3 KB
4	tapad.com 3 redirects pixel.tapad.com — Cisco Umbrella Rank: 446	1 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 2579	10 KB
4	mountain.com dx.mountain.com — Cisco Umbrella Rank: 4802 px.mountain.com — Cisco Umbrella Rank: 5019 gs.mountain.com — Cisco Umbrella Rank: 9568	11 KB
3	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1074	2 KB
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 962	839 B
3	t.co t.co — Cisco Umbrella Rank: 859	1 KB
3	rlcdn.com 3 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 462	848 B
3	contanuity.com intentstream.contanuity.com — Cisco Umbrella Rank: 54170 tracking.contanuity.com — Cisco Umbrella Rank: 17825	1 KB
3	google.com www.google.com — Cisco Umbrella Rank: 3	192 B
3	argusplatform.com tmp.argusplatform.com — Cisco Umbrella Rank: 329188 pixels.argusplatform.com — Cisco Umbrella Rank: 327978 webtracker.argusplatform.com — Cisco Umbrella Rank: 334208	4 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 25487 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23670	2 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 348	15 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	4 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	71 KB
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 516	501 B
2	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 413	3 KB
2	lijit.com 1 redirects ce.lijit.com — Cisco Umbrella Rank: 912	895 B
2	crwdcntrl.net 1 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 976	834 B
2	yahoo.com 1 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 495	504 B
2	smartadserver.com 1 redirects sync.smartadserver.com — Cisco Umbrella Rank: 1410	1 KB
2	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2566	909 B
2	intentiq.com 1 redirects sync.intentiq.com — Cisco Umbrella Rank: 993	2 KB
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 542 d.agkn.com — Cisco Umbrella Rank: 782	1 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 415	966 B
2	demandscience.com abm-tracking.demandscience.com — Cisco Umbrella Rank: 51915	3 KB
2	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 6545 api.omappapi.com — Cisco Umbrella Rank: 6555	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34
1	steelhousemedia.com px.steelhousemedia.com — Cisco Umbrella Rank: 13137	320 B
1	siteimproveanalytics.io 6033413.global.siteimproveanalytics.io — Cisco Umbrella Rank: 291663	149 B
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3660	12 KB
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 89	23 B
1	pippio.com 1 redirects pippio.com — Cisco Umbrella Rank: 751	633 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 1137	27 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1507	421 B
1	stickyadstv.com ads.stickyadstv.com — Cisco Umbrella Rank: 576	653 B
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 867	551 B
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6710	175 B
1	1rx.io sync.1rx.io — Cisco Umbrella Rank: 503	99 B
1	inzynk.io tags.inzynk.io — Cisco Umbrella Rank: 205998	442 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 960	15 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 311	14 KB
1	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 3455	710 B
1	opmnstr.com a.opmnstr.com — Cisco Umbrella Rank: 32696	17 KB
1	omtrdc.net fortinet.tt.omtrdc.net — Cisco Umbrella Rank: 316588	837 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1371	490 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	309 B
0	exelator.com Failed loadm.exelator.com Failed
0	smaato.net Failed s.ad.smaato.net Failed
235	63

	Domain	Requested by
67	www.fortinet.com	www.fortinet.com
23	assets.adobedtm.com	cdn.cookielaw.org assets.adobedtm.com
22	um.simpli.fi	19 redirects
11	b.6sc.co	www.fortinet.com
8	match.adsrvr.org	7 redirects
8	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com abm-tracking.demandscience.com
7	ml314.com	2 redirects www.fortinet.com ml314.com
6	px.ads.linkedin.com	3 redirects snap.licdn.com
6	cdn.cookielaw.org	www.fortinet.com cdn.cookielaw.org
5	ib.adnxs.com	3 redirects
4	pixel.tapad.com	3 redirects
4	tags.srv.stackadapt.com	www.fortinet.com tags.srv.stackadapt.com
4	td.doubleclick.net	www.googletagmanager.com
4	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
4	script.crazyegg.com	www.fortinet.com script.crazyegg.com
4	dpm.demdex.net	1 redirects www.fortinet.com
3	ps.eyeota.net	2 redirects
3	analytics.twitter.com
3	t.co
3	idsync.rlcdn.com	3 redirects
3	secure.adnxs.com	2 redirects
3	www.google.com	www.fortinet.com
3	bat.bing.com	assets.adobedtm.com bat.bing.com www.fortinet.com
2	px.mountain.com	dx.mountain.com px.mountain.com
2	www.facebook.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	10104846.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	cm.g.doubleclick.net	2 redirects
2	us-u.openx.net	1 redirects
2	pixel.rubiconproject.com	1 redirects
2	ce.lijit.com	1 redirects
2	bcp.crwdcntrl.net	1 redirects
2	ups.analytics.yahoo.com	1 redirects
2	sync.smartadserver.com	1 redirects
2	fei.pro-market.net	2 redirects
2	sync.intentiq.com	1 redirects
2	eb2.3lift.com	1 redirects
2	intentstream.contanuity.com	abm-tracking.demandscience.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	abm-tracking.demandscience.com	www.fortinet.com abm-tracking.demandscience.com
2	www.google-analytics.com	www.googletagmanager.com
2	tracking.crazyegg.com	script.crazyegg.com
2	eps.6sc.co	j.6sc.co
2	tr.outbrain.com	amplify.outbrain.com
2	amplify.outbrain.com	www.fortinet.com amplify.outbrain.com
1	insight.adsrvr.org	1 redirects
1	px.steelhousemedia.com
1	gs.mountain.com	px.mountain.com
1	webtracker.argusplatform.com	tmp.argusplatform.com
1	6033413.global.siteimproveanalytics.io
1	siteimproveanalytics.com	assets.adobedtm.com
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	tracking.contanuity.com	abm-tracking.demandscience.com
1	www.googleadservices.com	1 redirects
1	pippio.com	1 redirects
1	stags.bluekai.com
1	sync.bfmio.com
1	ads.stickyadstv.com
1	image2.pubmatic.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.1rx.io
1	tags.inzynk.io	assets.adobedtm.com
1	snap.licdn.com	www.fortinet.com
1	static.ads-twitter.com	www.fortinet.com
1	dx.mountain.com	www.fortinet.com
1	i.simpli.fi	tag.simpli.fi
1	pixels.argusplatform.com	tmp.argusplatform.com
1	cdn.jsdelivr.net	abm-tracking.demandscience.com
1	pixel.mathtag.com	www.fortinet.com
1	tmp.argusplatform.com	www.fortinet.com
1	trk.techtarget.com	www.fortinet.com
1	api.omappapi.com	a.opmnstr.com
1	a.omappapi.com	a.opmnstr.com
1	metrics.fortinet.com	www.fortinet.com
1	ad.doubleclick.net	www.fortinet.com
1	a.opmnstr.com	assets.adobedtm.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	wave.outbrain.com	amplify.outbrain.com
1	tag.simpli.fi	assets.adobedtm.com
1	j.6sc.co	www.fortinet.com
1	fortinet.tt.omtrdc.net	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	www.fortinet.com
1	geolocation.onetrust.com	cdn.cookielaw.org
0	loadm.exelator.com Failed
0	s.ad.smaato.net Failed
235	90

This site contains links to these domains. Also see Links.

Domain
forums.ivanti.com
www.horizon3.ai
www.cisa.gov
www.rapid7.com
www.fortiguard.com
www.linkedin.com
www.x.com
www.youtube.com
www.instagram.com
www.facebook.com
fortiguard.com
community.fortinet.com
investor.fortinet.com
onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-16` - `2025-07-15`	a year	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
script.crazyegg.com Cloudflare Inc ECC CA-3	`2024-08-02` - `2024-12-31`	5 months	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-14` - `2024-12-14`	a year	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google-analytics.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-27` - `2025-09-25`	a year	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-06-30` - `2025-07-30`	a year	crt.sh
a.opmnstr.com R10	`2024-09-21` - `2024-12-20`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.doubleclick.net WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
metrics.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-26` - `2025-01-25`	a year	crt.sh
a.omappapi.com R10	`2024-09-21` - `2024-12-20`	3 months	crt.sh
omappapi.com WE1	`2024-10-12` - `2025-01-10`	3 months	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
abm-tracking.demandscience.com R10	`2024-10-13` - `2025-01-11`	3 months	crt.sh
tmp.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
*.mathtag.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-04-23` - `2025-04-30`	a year	crt.sh
*.google.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
ibc-flow.techtarget.com WR3	`2024-08-28` - `2024-11-26`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
intentstream.contanuity.com E5	`2024-10-14` - `2025-01-12`	3 months	crt.sh
pixels.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-08` - `2025-03-08`	6 months	crt.sh
*.mountain.com Go Daddy Secure Certificate Authority - G2	`2024-05-23` - `2025-06-24`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M03	`2024-08-09` - `2025-09-06`	a year	crt.sh
*.inzynk.io Amazon RSA 2048 M02	`2024-01-07` - `2025-02-04`	a year	crt.sh
tracking.contanuity.com R11	`2024-09-11` - `2024-12-10`	3 months	crt.sh
t.co E5	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-09` - `2025-10-08`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-07-24` - `2024-10-22`	3 months	crt.sh
siteimproveanalytics.com WE1	`2024-08-19` - `2024-11-17`	3 months	crt.sh
44.212.189.233 Sectigo RSA Domain Validation Secure Server CA	`2024-01-26` - `2025-02-15`	a year	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-08-21` - `2024-11-19`	3 months	crt.sh
*.global.r1.siteimproveanalytics.io Amazon RSA 2048 M02	`2024-09-02` - `2025-10-01`	a year	crt.sh
webtracker.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Frame ID: 4B32C4D210E1A09D93DAF209A0086EB9
Requests: 228 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 6600B976948BE8A65DBF7531267926F5
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/609297413?random=1729001507651&cv=11&fst=1729001507651&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 55B8706915DE83840DB069BB7F13884C
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=1369907835.1729001507;ps=1;pcor=1279793537;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Frame ID: 14250DD75B2A4F3F89707E8F7C330716
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/662878185?random=1729001507778&cv=11&fst=1729001507778&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 55B568A000E09192E55F6158908DF192
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/729495989?random=1729001507844&cv=11&fst=1729001507844&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 7361171D0115392888A35D5DE47B4061
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=CPCbscbIkIkDFamqjggdyt0dHQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3435340169617.6313
Frame ID: 3A186448B9D0A28DB872ACE742B71CBC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA | FortiGuard Labs

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

FingerprintJS (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/fingerprintjs@(\d)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

235
Requests

85 %
HTTPS

27 %
IPv6

63
Domains

90
Subdomains

74
IPs

2
Countries

6438 kB
Transfer

10291 kB
Size

122
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190?language=de
Title: CVE-2024-8190

Search URL Search Domain Scan URL

URL: https://www.horizon3.ai/attack-research/cisa-kev-cve-2024-8190-ivanti-csa-command-injection/
Title: the details

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
Title: here

Search URL Search Domain Scan URL

URL: https://www.rapid7.com/blog/post/2024/01/11/etr-zero-day-exploitation-of-ivanti-connect-secure-and-policy-secure-gateways/
Title: here

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/threat-signal-report/5556
Title: https://www.fortiguard.com/threat-signal-report/5556

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/encyclopedia/ips/56651
Title: https://www.fortiguard.com/encyclopedia/ips/56651

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.x.com/Fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fortinet/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://community.fortinet.com/
Title: Fortinet Community

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 77

https://cm.everesttech.net/cm/dd?d_uuid=80879264112703762071257771742052073124 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zw54IgAAAHF-AANP

Request Chain 167

https://secure.adnxs.com/px?id=1773420&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Request Chain 168

https://ib.adnxs.com/seg?add=36113683 HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Request Chain 170

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=613CCCB341A147B5857B261E2C187A9E

Request Chain 171

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/613CCCB341A147B5857B261E2C187A9E

Request Chain 172

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=613CCCB341A147B5857B261E2C187A9E&dongle=yf3 HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=613CCCB341A147B5857B261E2C187A9E&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

Request Chain 173

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=613CCCB341A147B5857B261E2C187A9E

Request Chain 174

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=613CCCB341A147B5857B261E2C187A9E HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=613CCCB341A147B5857B261E2C187A9E

Request Chain 175

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=613CCCB341A147B5857B261E2C187A9E HTTP 302
https://d.agkn.com/pixel/10751/?che=1729001509684&ip=162.245.206.244&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D213610605036309356329 HTTP 302
https://um.simpli.fi/aa_px?sk=213610605036309356329 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 176

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=613CCCB341A147B5857B261E2C187A9E HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=613CCCB341A147B5857B261E2C187A9E&ckls=true&ci=yHGn5YxzMg&nc=false&trid=-1147361809

Request Chain 177

https://um.simpli.fi/pubmatic HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:613CCCB341A147B5857B261E2C187A9E

Request Chain 178

https://um.simpli.fi/freewheel HTTP 302
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=613CCCB341A147B5857B261E2C187A9E

Request Chain 179

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=613CCCB341A147B5857B261E2C187A9E;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=613CCCB341A147B5857B261E2C187A9E;mimetype=img;sr HTTP 302
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Ffei.pro-market.net%2Fengine%3Fsite%3D161185%26size%3D1x1%26du%3D36%26csync%3D[sas_uid] HTTP 302
https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1

Request Chain 180

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=613CCCB341A147B5857B261E2C187A9E&j=0

Request Chain 181

https://um.simpli.fi/yahoo HTTP 302
https://ups.analytics.yahoo.com/ups/55964/sync?uid=613CCCB341A147B5857B261E2C187A9E HTTP 302
https://ups.analytics.yahoo.com/ups/55964/sync?uid=613CCCB341A147B5857B261E2C187A9E&verify=true

Request Chain 182

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=613CCCB341A147B5857B261E2C187A9E

Request Chain 183

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=613CCCB341A147B5857B261E2C187A9E

Request Chain 184

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=613CCCB341A147B5857B261E2C187A9E HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=613CCCB341A147B5857B261E2C187A9E

Request Chain 185

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=613CCCB341A147B5857B261E2C187A9E HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=613CCCB341A147B5857B261E2C187A9E&dnr=1

Request Chain 186

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=613CCCB341A147B5857B261E2C187A9E HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogNjEzQ0NDQjM0MUExNDdCNTg1N0IyNjFFMkMxODdBOUUQABoNCKXwubgGEgUI6AcQAEIASgA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=2b3f7fbcb9a33575d4861409f0de9a7208aeb8b64ddf7f3ba430b48d094c75ea791426b5417dce21&_=2 HTTP 307
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=2b3f7fbcb9a33575d4861409f0de9a7208aeb8b64ddf7f3ba430b48d094c75ea791426b5417dce21&rand=01523604

Request Chain 187

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1729001508643&cv=7&fst=1729001508643&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=613363999&cv=7&fst=1729001508643&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybEC&pscrd=IhMI68ChxsiQiQMVPDnQBB1tKwfxMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=613363999&cv=7&fst=1729001508643&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybEC&pscrd=IhMI68ChxsiQiQMVPDnQBB1tKwfxMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfjFmNuqwm8Yahizac7To4P_dy1ihuoI3qj8I3f_8wssjYqwqL&random=3920053569

Request Chain 189

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=613CCCB341A147B5857B261E2C187A9E

Request Chain 190

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=613CCCB341A147B5857B261E2C187A9E&expires=365

Request Chain 191

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=613CCCB341A147B5857B261E2C187A9E HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=613CCCB341A147B5857B261E2C187A9E

Request Chain 192

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_error=15

Request Chain 204

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&li_adsId=92114b72-59db-45a7-91f3-0be6fa2ace23&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&li_adsId=92114b72-59db-45a7-91f3-0be6fa2ace23&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%252C6313418%26time%3D1729001509173%26li_adsId%3D92114b72-59db-45a7-91f3-0be6fa2ace23%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&li_adsId=92114b72-59db-45a7-91f3-0be6fa2ace23&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&li_adsId=92114b72-59db-45a7-91f3-0be6fa2ace23&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cookiesTest=true&liSync=true&e_ipv6=AQJv9EQWX805GgAAAZKQhVThgIMwtdgeiuOPT2YIrEZ702GuejRN2voGH440coBr625pXg

Request Chain 205

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3435340169617.6313 HTTP 302
https://10104846.fls.doubleclick.net/activityi;dc_pre=CPCbscbIkIkDFamqjggdyt0dHQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3435340169617.6313

Request Chain 211

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1729001508702 HTTP 303
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1729001508702&_bee_ppp=1 HTTP 303
https://tracking.contanuity.com/usersync?bwcookie=AAFNRk7OHPAAABOsi8_mkQ

Request Chain 220

https://idsync.rlcdn.com/395886.gif?partner_uid=3647725149520134151 HTTP 307
https://ml314.com/csync.ashx?fp=36da98ba0d466c05d2223be8d247edb4bdce22b483ea1178c067cd963f318f9ff4cb09cee1a4f8eb&person_id=3647725149520134151&eid=50082

Request Chain 221

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&gdpr=0&gdpr_consent=

Request Chain 222

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3647725149520134151%26eid=2 HTTP 302
https://ml314.com/csync.ashx?fp=468448509069140886&person_id=3647725149520134151&eid=2

Request Chain 223

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2X7L1Zw3GpVD2rayQ0aPuro3bI5ZZ02lMJiSQ1i91FOU&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ml314.com/csync.ashx?fp=2X7L1Zw3GpVD2rayQ0aPuro3bI5ZZ02lMJiSQ1i91FOU&person_id=3647725149520134151&eid=50052&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

Request Chain 232

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=6cc5cb1b-8aff-11ef-b004-333b298a5d6e&gdpr=&gdpr_consent= HTTP 302
https://px.steelhousemedia.com/tdsync?tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&shguid=6cc5cb1b-8aff-11ef-b004-333b298a5d6e

Request Chain 233

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=468448509069140886&ttd_tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ODI1ZWE0ODYtYjIxYS00ZGEzLTk3ZmYtZTFhMjZiMGNhMGVl&gdpr=0&gdpr_consent=&ttd_tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&google_error=15 HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad HTTP 302
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D1330d32d-bed1-42d1-9521-417993b920ac%252Chttps%25253A%25252F%25252Fmatch.adsrvr.org%25252Ftrack%25252Fcmf%25252Fgeneric%25253Fttd_pid%25253Dtapad%252C HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=468448509069140886&pt=1330d32d-bed1-42d1-9521-417993b920ac%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%252Fgeneric%253Fttd_pid%253Dtapad%2C HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad

235 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa Show response
www.fortinet.com/blog/threat-research/ 133 KB
31 KB 424ms
133ms Document
text/html 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

e43a78cb528d99356d4426d8975072a19dbbbd71273d0d746f1287a2696d6853

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Age: 4215
Cache-Control: max-age=600, public, s-maxage=10800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 30578
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Type: text/html;charset=utf-8
Date: Tue, 15 Oct 2024 13:02:47 GMT
ETag: "21455-624838d47e4b4-gzip"
Last-Modified: Tue, 15 Oct 2024 13:01:29 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qhQreC_--xPrsHeWtyObzbSFO0Uvel6OiSfYpABsf4wNSZ7MZxOV_A==
X-Amz-Cf-Pop: IAD61-P4
X-Cache: Hit from cloudfront
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1-28559771
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK visitorapi.min.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 64 KB
30 KB 384ms
132ms Script
application/javascript 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "fe2d-6117284c96900-gzip"
Age: 1011652
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 8Qekih4Jrj9xp7xgTYD6zJOKYyiUBbGiWawWpZSN5arQMiJUnVN9ww==
Date: Tue, 15 Oct 2024 14:10:47 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 15 Feb 2024 21:43:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29532
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK at.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 104 KB
48 KB 388ms
135ms Script
application/javascript 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "19e83-61431fc4b24c0-gzip"
Age: 310470
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: U3jy09nlns9RDqV-q0DjzMlD3I25CHHS_SNSI364Gf8tGZXl-MKuVA==
Date: Fri, 11 Oct 2024 23:57:14 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 21 Mar 2024 20:59:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47782
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 540 KB
28 KB 244ms
130ms Stylesheet
text/css 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "86e1b-61b58883c7740-gzip"
Age: 1011489
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 2nuoEAqAKmLjbgADENes6_wR-XExe3QgQ5QD_NrkTz2f23WvwdRpRw==
Date: Tue, 15 Oct 2024 14:01:47 GMT
Content-Type: text/css;charset=utf-8
Last-Modified: Thu, 20 Jun 2024 20:55:17 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27478
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 231ms
81ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: jwlUUXc1HMPClYXMpY+NPQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCECBD439DB9BF
x-ms-lease-status: unlocked
age: 2153
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 13:35:51 GMT
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript
last-modified: Tue, 15 Oct 2024 02:01:20 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 8f7ade6b-901e-0064-2ea7-1e232a000000
cf-ray: 8d30666a1b867cf1-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6881
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 384ms
132ms Image
image/svg+xml 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 517155
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Y5nC2--SVp6Uopvkfokn6e4ED78biaENJvg6Me2n8mujs1V43hnqKw==
Date: Wed, 09 Oct 2024 14:32:29 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
3 KB 386ms
134ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4fd-60a2031eb4f40"
Age: 29018240
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: r2FPuUFveaDlvweSonfJpI7OzXhVD0M7tW2CgAfVcuLSyRO4MALD_Q==
Date: Tue, 15 Oct 2024 14:01:47 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 160 KB
74 KB 131ms
131ms Script
application/javascript 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "28100-61cff12ce1d80-gzip"
Age: 1011643
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: WzMVw_0ND8a1GMZHp38ZWuniYdV1j_yd0BrTm5Te9m97GqEJFVMWwQ==
Date: Tue, 15 Oct 2024 14:10:40 GMT
Content-Type: application/javascript;charset=utf-8
Vary: Accept-Encoding
Last-Modified: Thu, 11 Jul 2024 21:01:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 74768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 5 KB
2 KB 247ms
108ms XHR
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Uj3iBUKm1Vl2g2NHq67V+w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF23DF5130
age: 66628
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Wed, 16 Oct 2024 14:11:44 GMT
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/json
last-modified: Thu, 28 Dec 2023 19:56:54 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 964c1177-301e-008d-4857-790e51000000
cf-ray: 8d30666bad802b7a-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1792
x-ms-blob-type: BlockBlob
server: cloudflare

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK ivanti-hero.jpg
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 220 KB
222 KB 135ms
135ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/ivanti-hero.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

18041a7dd2be9d4ba5469edca86d5bd763e3bdcae7a83c5559c618bf4be83f0f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3715e-6242cd5d60d40"
Age: 333281
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 5l2Bx4Z8G1OUMQdt3dfkcqibP5qwdu92Nh7jrx6ybcPjLLWmZTMLVA==
Date: Fri, 11 Oct 2024 17:45:35 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:34:05 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 225630
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK siemens-vuln-discovery-center-thumb.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 146 KB
147 KB 128ms
128ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/siemens-vuln-discovery-center-thumb.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b3f4fd3661f04c2c6374215073e85cb8c5c938ee783677f40e85151989c39d97

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "24631-5e417b82eaa40"
Age: 36202771
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ut-lQ282vKZVTvm4Zc6d7WCZVfyxqmFT6qVUBpeFfKR_v_Wqb3ksYA==
Date: Tue, 15 Oct 2024 14:08:00 GMT
Content-Type: image/png
Last-Modified: Mon, 18 Jul 2022 17:30:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 149041
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ransomware-roundup-thumb.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 142 KB
144 KB 129ms
129ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/ransomware-roundup-thumb.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

727d19bf895438013bb188825e546dd6e61f80c2a4ea8e7b6e978b96bab546f4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "23995-5e41c8188d9c0"
Age: 36204710
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: oBQZdaXeAL__VRL1VdAKU_-IXrXrlawwNrPjRgY0bEoxp9jrUwKyAA==
Date: Tue, 15 Oct 2024 14:08:00 GMT
Content-Type: image/png
Last-Modified: Mon, 18 Jul 2022 23:12:47 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 145813
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK MOVEIT-THUMB.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 124 KB
126 KB 132ms
131ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/MOVEIT-THUMB.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

443f47f0ae01cec5b4bc117dffb451485e147a54865efa7c820320e68cb55909

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1f0d8-5fd8fff10e040"
Age: 36204759
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Kfev2omc_w4NaJWZOL9Ggb-nqiyimg3CzdSS01hzQ6NA6-qlp3wgWA==
Date: Tue, 15 Oct 2024 14:08:00 GMT
Content-Type: image/png
Last-Modified: Wed, 07 Jun 2023 20:29:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 127192
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
38 KB 137ms
131ms Font
application/octet-stream 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Response headers

X-Vhost: publish
ETag: "9354-5df4fa74ff980"
Age: 1005630
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: MrKAyqwBGc9od3LZPp-0ukWYCeWX3Q9fOY0Orf040NEyy1EBqY7mVA==
Date: Fri, 04 Oct 2024 00:03:55 GMT
Content-Type: application/octet-stream
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37716
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 71 B
309 B 427ms
92ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4da8a6638ad70698ad3d01aa0ef124aebe35c297685c0796b174822f597b1d09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8d30666e7d967ba3-LAX
access-control-allow-origin: *
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK ivanti-web-request-client-index.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1728620161388/ 46 KB
47 KB 130ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1728620161388/ivanti-web-request-client-index.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

26b37b2982358112ad578340484a7de6274a19db3fb6ea13f0b4e2d89e35f566

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "b76f-6242bbea5e240"
Age: 40880
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: cGk3UA5ttfIuvK-tDNyfrkR378KEiiSon8fhwHfxGaoQdh0AugJ09Q==
Date: Tue, 15 Oct 2024 13:02:48 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 46959
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig01-ivanti-gui-dl-landesk.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1172236801.img.jpeg/1728620210875/ 93 KB
94 KB 128ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1172236801.img.jpeg/1728620210875/fig01-ivanti-gui-dl-landesk.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

1d3e1ffd86a5653412775034689e08d77352a1a255038f3cf953b76318ac946a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1733a-6242bc1919080"
Age: 40880
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: T8fVV6bcoGcKkJNs9iFMz7IbUn8l8m867vUb0d01tii1xIWC6F0LHA==
Date: Tue, 15 Oct 2024 13:02:48 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:16:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 95034
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig02-ivanti-redirection-download.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2006588417.img.jpeg/1728620263874/ 15 KB
16 KB 131ms
130ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2006588417.img.jpeg/1728620263874/fig02-ivanti-redirection-download.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

933ddaeb7b389ab0803e3e7a1124cd51dcd097514e5e1cff4d4cef50b219779e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3bfd-6242bc4ba47c0"
Age: 40880
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: SqDNofDU9fMwIWp9RYpxf73UZ-3xR_5i_MV9bU9a0F6ci7g7yrBzbQ==
Date: Tue, 15 Oct 2024 13:02:48 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:17:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 15357
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig03-ivanti-redirection-ondemand.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_184115790.img.jpeg/1728620317634/ 8 KB
9 KB 129ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_184115790.img.jpeg/1728620317634/fig03-ivanti-redirection-ondemand.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

17095b0dfaded492b73f4f6a30412ecb2f7a87a2ebd1f8963d5c5cee3db937bd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2011-6242bc7f24140"
Age: 40881
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Zn4CV4IN-hDondCgKirnCKuftv80zgzLUSYkgWnarIWXoI34WSL2Cg==
Date: Tue, 15 Oct 2024 13:02:48 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:18:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 8209
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig04-ivanti-code-vulnerable.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_853574561.img.jpeg/1728620365076/ 44 KB
46 KB 132ms
131ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_853574561.img.jpeg/1728620365076/fig04-ivanti-code-vulnerable.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

80979b936a389e029f1d96f9b57e39257416add377d59a14c91708c48cc60ae2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "b104-6242bcacead40"
Age: 40879
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ru6B1kY8Up2FDWxx3u1xr7-IfVTzU3Q6LhNPiAjOZRrR1n2UcjJBdw==
Date: Tue, 15 Oct 2024 13:02:48 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:19:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 45316
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-client-index-gsb-users.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_870303825.img.jpeg/1728620426185/ 17 KB
18 KB 131ms
131ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_870303825.img.jpeg/1728620426185/ivanti-client-index-gsb-users.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f53109bc9c1f5eba5a8e47a82b8a8e12de6fdd2c81f0a5320d5cd457708a5324

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "43b0-6242bce717680"
Age: 40664
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: rltF7-lrI6VE7bNlijoOHfxlwaLymiGnWkQfk3cwonY7-LaqOHKy6Q==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:20:26 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 17328
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig05-ivanti-path-traversal.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1543583598.img.jpeg/1728620510929/ 59 KB
60 KB 132ms
131ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1543583598.img.jpeg/1728620510929/fig05-ivanti-path-traversal.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

cbe67b5b6fa27d2f9d4f18dba4f940ce8c4a3dbcab1541b5b1023ce4dcea66e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "ebd4-6242bd3733380"
Age: 40880
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: aC1EmarkY5Z02U9oOsS-dPM7B7yIpFq_t3_Dm7UzOFPPpIdnIQkP7Q==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:21:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 60372
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig06-ivanti-path-traversal-vulnerability.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1413617697.img.jpeg/1728620553579/ 126 KB
127 KB 129ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1413617697.img.jpeg/1728620553579/fig06-ivanti-path-traversal-vulnerability.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a364f8998ea88f243a482109d256626e8d7cb72a05eac69ac608c27435241a65

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1f626-6242bd6035440"
Age: 40836
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ymEKeDg1EWuRe1AGPd3j2eqYQOGi_wTjcdM8Pjl_aOtpbA3rbnwb0Q==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:22:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 128550
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-csa-management-console.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2028077941.img.jpeg/1728620592057/ 31 KB
32 KB 129ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2028077941.img.jpeg/1728620592057/ivanti-csa-management-console.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d4edec0e6d150110e180ad38f47e5eab79358d5df97f12e15c73a4b538863451

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ada-6242bd8566c00"
Age: 40880
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: RcVvOFpAky_qQ3aOcmzBbI0NjPlNkhMLeUUrA9VfeYtDCK2NVq9ovA==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:23:12 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31450
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig07-ivanti-sqli-vulnerabilty-exploitation.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_288801384.img.jpeg/1728620655617/ 173 KB
174 KB 136ms
135ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_288801384.img.jpeg/1728620655617/fig07-ivanti-sqli-vulnerabilty-exploitation.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

ad15ab06d640d365a00d41e146660addb01348b2f6878f6ffdc1dc428c67cc19

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2b2af-6242bdc17b9c0"
Age: 40879
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: rDQYFDiUi4gckPagnqDWocj-nMLC4RaxFoUOXwQSt-yLBivtsIdOIA==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:24:15 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 176815
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig08-ivanti-setting-timezone-value.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_512758081.img.jpeg/1728620707132/ 25 KB
26 KB 128ms
127ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_512758081.img.jpeg/1728620707132/fig08-ivanti-setting-timezone-value.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0e6e31465592638aaa036384d85ebd6e6c56b9178591bceea4a0b815dd06d535

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "6205-6242bdf312ec0"
Age: 40833
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: byFLOhj_PUYQBX0T6UFaYKexjrvPRJObfydtB6AJSrAWrMW-HK5tqA==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:25:07 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 25093
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig09-ivanti-vulnerabie-function.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_156964748.img.jpeg/1728620764864/ 29 KB
31 KB 128ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_156964748.img.jpeg/1728620764864/fig09-ivanti-vulnerabie-function.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

7c37b5d2c568700acb5aa4d6fc9ece9bc0df8882dc473d944a854ade711a696c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "758d-6242be296ef00"
Age: 40833
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: KGHGkz7magkwMOnk06c-vzJRZSy1eH7Ca1j26-p0ugeUE1E1r2vL3A==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:26:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 30093
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig10-ivanti-time-zone-change.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_546641334.img.jpeg/1728620805020/ 58 KB
59 KB 127ms
127ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_546641334.img.jpeg/1728620805020/fig10-ivanti-time-zone-change.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

ec5a240780ab83205367dfb9274a408269d2a10d837164fe39eebabd757d9e7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "e618-6242be5088b40"
Age: 40836
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: cQqxYhicLKAU6TqPj4iYJ13FARoHlEeSNMx0ZA3Emxo0miQ6Zf-6XA==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:26:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 58904
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig11-ivanti-post-variable-timezone.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_879745814.img.jpeg/1728620849864/ 87 KB
89 KB 132ms
131ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_879745814.img.jpeg/1728620849864/fig11-ivanti-post-variable-timezone.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f21e3a5a80821feb91e7bb84d525742fd137c4b336f3ff3f1bb15dc2fcae9d70

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "15d27-6242be7a7ee40"
Age: 40879
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: imqSw-RE0oAq4ZDWnmrNf9tBGDpg0akaZ5OAjp1U0twORadXpKf46g==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:27:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 89383
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig12-ivanti-decoded-base64.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1686730515.img.jpeg/1728620888293/ 112 KB
114 KB 129ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1686730515.img.jpeg/1728620888293/fig12-ivanti-decoded-base64.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8af6fb23ba1c0a4860476b240ba2d05c02ff018f1a93d2caadf7301ed87223d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1c1e7-6242be9fb0600"
Age: 40833
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: gdUMwBfdOvVnl3NbJIbgzEeTNYzYtNOm4NKto4YXOX3zUJwGVZbOqg==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:28:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 115175
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig13-ivanti-broker-conf.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_658029349.img.jpeg/1728620938935/ 31 KB
32 KB 129ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_658029349.img.jpeg/1728620938935/fig13-ivanti-broker-conf.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0968bbb30f1aef951bb770793756fca4fd75cce26bce318ace9c6e31deddf7f6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ab8-6242becf5f680"
Age: 40878
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: YzPJuwBXQ1v33m0pyFFPEpf05a9ZEL0tx1iw8mtypRg16uxr9zuGAQ==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:28:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31416
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig14-ivanti-root-user-private-key.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_669364972.img.jpeg/1728620991417/ 11 KB
13 KB 128ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_669364972.img.jpeg/1728620991417/fig14-ivanti-root-user-private-key.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bd6f701d7b3abd41679f87c496bc8911a602f247900dfc7ab7cb3a62abe098ee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2cda-6242bf01eadc0"
Age: 40878
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 7aUiLGAa7o3KiYFd-W9LDnbSzPVDL9NZE4zbBjWLa2c5svORibDEUQ==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:29:51 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 11482
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig15-ivanti-postgres-database.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_801722592.img.jpeg/1728621025851/ 96 KB
98 KB 128ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_801722592.img.jpeg/1728621025851/fig15-ivanti-postgres-database.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b69b5763c6c912b8a1852981c4401647963d63734e234b073d97c0dffbf64206

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "180ac-6242bf2257a40"
Age: 40878
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: iA-DdDIWM7eSd4lEI_nfA3Hd4IV6FnHXEBITaRE1zN645rGPPKEtDg==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:30:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 98476
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig16-ivanti-command-injection.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841058103.img.jpeg/1728621069609/ 111 KB
112 KB 129ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841058103.img.jpeg/1728621069609/fig16-ivanti-command-injection.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

cff43ffcd3d9feaba4fb1250d800a3b9650a7f65c26f00b196e403cc763ee1d4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1bbea-6242bf4c4dd40"
Age: 40878
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: q9xJn5aN2TCIkI7nK-ARacm7NynnboPA-ntPSyko5qRLGGepfRadKg==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:31:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 113642
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-malicious-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1382954794.img.jpeg/1728621104113/ 16 KB
17 KB 133ms
132ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1382954794.img.jpeg/1728621104113/ivanti-malicious-command.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d3cdd8255b0cabf4568ec33c19f12ef6a3a761ea27bb36f0e1a12d9c4f31a2f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3ec2-6242bf6daec00"
Age: 40878
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: G7TwaHBD3ncvOSKEyCMQu3dFgRcufbZnspsqaTSJmrUU5Rq1r9Rhzg==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:31:44 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 16066
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig17-ivanti-command-injected.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_611292844.img.jpeg/1728621139581/ 18 KB
19 KB 130ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_611292844.img.jpeg/1728621139581/fig17-ivanti-command-injected.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f797f871bec64d4d54308abab8c7008df6b855a83b59dbc17665e3c4111e7032

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4858-6242bf8f0fac0"
Age: 40877
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: PnDW1hcdkFpHCrHwI0qYhw5lq9ZrN1IK-SW29Jl2P9yaUWpbfL2EOg==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:32:19 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 18520
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig18-ivanti-code-vulnerable.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_115137765.img.jpeg/1728621184124/ 70 KB
71 KB 130ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_115137765.img.jpeg/1728621184124/fig18-ivanti-code-vulnerable.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

c584b5d0f98a654a3857877fa1e3dbb85b0b0e779191ad952af4e14116205e2c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "11771-6242bfb9fa000"
Age: 40877
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: T134y0C_arFRY0aJNsA58lTq_HyEuZBWBSyoJB4ohEuUojUSKRSzBg==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:33:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 71537
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig19-ivanti-update-function.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2034876463.img.jpeg/1728621223395/ 55 KB
56 KB 131ms
130ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2034876463.img.jpeg/1728621223395/fig19-ivanti-update-function.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

5cde97a99252b4ad4fa0d3becd808a64e2b1946feef502515a47aab3f9110f7c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "da41-6242bfdf2b7c0"
Age: 40877
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: H6ty1OFipYNMByWrKdp8jPHTAGeYCwOTonG-38uVBhpzTFXbk40YwQ==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:33:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 55873
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig20-ivanti-files-patch.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_450058568.img.jpeg/1728621256835/ 87 KB
88 KB 130ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_450058568.img.jpeg/1728621256835/fig20-ivanti-files-patch.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a9a345b743fb7460be8d7e10ca085ea57901980b67d43151196d36f94a5451cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "15a79-6242bffea4200"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: wmcgJ-sZuBInz3cSWxJS_i50sn9nxbv2aVra2EWoIFnhASY6SOs1TQ==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:34:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 88697
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig21-ivanti-patch-script.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1942091345.img.jpeg/1728621289333/ 101 KB
103 KB 130ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1942091345.img.jpeg/1728621289333/fig21-ivanti-patch-script.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

36186e198e296c76785020a85f35312fbf538fe48f96b8358b01c25cb5b673e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1958b-6242c01e1cc40"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: T73tZroPbfUw1nL77XvX1Jak2RdnzwwUIlgHHmcnMJU0_Uk8-WsbXw==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:34:49 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 103819
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-temp-tmp-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_479439523.img.jpeg/1728621332478/ 29 KB
30 KB 131ms
130ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_479439523.img.jpeg/1728621332478/ivanti-temp-tmp-command.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

18f5794db26670e34d8df06806be8536dc6520a380dcf67bced51fc8f7ef91e1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "73b9-6242c0471ed00"
Age: 40877
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: w-V4NtSama30HQ6GLEmN8jxYfNmOTxCu6mec4psXaE50_lg8XPxcoA==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:35:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29625
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig22-ivanti-patch-timestamp.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_280612408.img.jpeg/1728621400402/ 22 KB
24 KB 129ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_280612408.img.jpeg/1728621400402/fig22-ivanti-patch-timestamp.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

4aa70a752741f88840c0ae6612f71b6220ac77080c263caa1682cee47d9b39da

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "59be-6242c087f8600"
Age: 40877
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 8JaZPVE5oTH--l-MYXnhmv9D8lyboczwvjJ45xA3c-W2qriVq4ptVg==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:36:40 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 22974
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig23-ivanti-patch-timestamp-datetimetab.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1121393809.img.jpeg/1728621473905/ 15 KB
16 KB 132ms
130ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1121393809.img.jpeg/1728621473905/fig23-ivanti-patch-timestamp-datetimetab.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

643a52fac3e3aae163ef76ad0a2a088d2f31ac2552eff000edc1b495c8fbba32

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3c34-6242c0cd96a40"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: jJyDg6u-4-up2hYwnENWffuXl1OJ-033RXI0J7Iur3eJIswkciD5TQ==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:37:53 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 15412
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig24-ivanti-comparison-code.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1656384028.img.jpeg/1728621510804/ 93 KB
94 KB 130ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1656384028.img.jpeg/1728621510804/fig24-ivanti-comparison-code.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8ef9e9b7103e38d4509a125612dad3ff98edfd671fa45f01d4d09c3cefa50a8f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1737c-6242c0f0dfd80"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: WrP7YxGd6RVnIw-Idw5fpw6lByPUKcXVaU32teBTiia8Gh1JlInpEQ==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:38:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 95100
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig25-ivanti-exploitation-testing.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1136962043.img.jpeg/1728621561290/ 129 KB
130 KB 129ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1136962043.img.jpeg/1728621561290/fig25-ivanti-exploitation-testing.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bb13a80fdd4875e6626de9e2b4ebf7948f3cfe191f73b4dbf31e1247d0239667

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "20339-6242c12183040"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: eOKwBgzFHC4hNCRlbu-GzOZQhGNgEn7DE99bn2vfcFY7bS3sJXNfeg==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:39:21 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 131897
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig26-ivanti-testing-command-injection.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1958099435.img.jpeg/1728621691327/ 107 KB
108 KB 128ms
127ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1958099435.img.jpeg/1728621691327/fig26-ivanti-testing-command-injection.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bec3437c8baa45a6344648c2bb6806831972c5cdd7ae34a16897d6e205092476

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1ab81-6242c19d7d4c0"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: DlFf1xRS-xKK9DxumZlnbr5q3S0GlzYOC1DW4jXdQOe2xyP8RV6CBA==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:41:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 109441
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-sample-malicious-post.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2136686996.img.jpeg/1728621736636/ 65 KB
66 KB 132ms
132ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2136686996.img.jpeg/1728621736636/ivanti-sample-malicious-post.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

1a8491dacfaed6de53e20ff200c81255fb61def72f2696426a23ec5a05265b28

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10408-6242c1c867a00"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: X563789J_Zza3HfFGl8xnOcUJGfOZ95TlwKcyxKX2DLIAkDEC4RPHA==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:42:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 66568
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-sqls-remote-code-execution.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_958399012.img.jpeg/1728621780661/ 89 KB
90 KB 129ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_958399012.img.jpeg/1728621780661/ivanti-sqls-remote-code-execution.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d5dc4157271c9d3147055b0f2b85578271417af24cb1cfd197b84194ddaa0bfa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "16350-6242c1f25dd00"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: mJn4Z3U8Yb2lb9RQar-WtTnMjm5VdFSEeyOhnL2r5IYPAP4mZ_dhuQ==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:43:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 90960
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table01-ivanti-threat-actor-commands.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_133352251.img.jpeg/1728621923615/ 50 KB
51 KB 128ms
127ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_133352251.img.jpeg/1728621923615/table01-ivanti-threat-actor-commands.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

717f11c79608856a33546a50fe20ac984c44c933ba23ea02c851f8f0004df1fd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "c75d-6242c27abdec0"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: OzUIsi-A1ANe8WJtDdU40QjH0sc1cE7OFd1hfdWW-sDjcmcqwTXbPA==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:45:23 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 51037
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-powershell-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1877150742.img.jpeg/1728621963572/ 77 KB
79 KB 130ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1877150742.img.jpeg/1728621963572/ivanti-powershell-command.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b0b526b901a7afeac92efcd87a441305a26891bba8bfbb950f4b18f7fd582e59

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "134e8-6242c2a0e38c0"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: izoLlJUF7pZ4VdUSo8ZJSeOOqPvH5X4U2lPPu8tD_V2Km9EBZrtgpg==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:46:03 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 79080
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig27-ivanti-content-1log.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1065565645.img.jpeg/1728622001838/ 51 KB
53 KB 128ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1065565645.img.jpeg/1728622001838/fig27-ivanti-content-1log.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

5fa043f0c7d87051071a76bfcd9a59a537991943ba96fde8cc718c5a0919b45b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "ccf0-6242c2c520e40"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: HI9W4cAW6Zb2khZlakn-xn5qFiRlLF0r3CjXaXKjDoBnkuW_wXazkg==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:46:41 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 52464
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table02a-ivanti-threat-actor-commands.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_554353955.img.jpeg/1728661138131/ 1003 KB
1004 KB 128ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_554353955.img.jpeg/1728661138131/table02a-ivanti-threat-actor-commands.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

4af5dacf19bc195010075d202d98f083a444a8572cbc1711fe39225928cb6be1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "faaf9-6243549114880"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Hx3jv5fY6unL3PMOT3u8TIf1bUpHs-xQIZLgX3Iu67k5Q35QOsS4uA==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 15:38:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1026809
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table03-ivanti-web-shells.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1145145370.img.jpeg/1728622608310/ 80 KB
82 KB 130ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1145145370.img.jpeg/1728622608310/table03-ivanti-web-shells.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

92cfae0b0d343d93e5e1d365bb9179904e50407d803588ec009e2bb19e211ea3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1416e-6242c50802400"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 0hcJsYSxTnIcBL5M0tEHyC5HUeFP0MU0alyCtoGDbeSMborsOOb1Xg==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:56:48 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 82286
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig28-ivanti-brute-force-tooling.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1202021139.img.jpeg/1728622643931/ 37 KB
38 KB 129ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1202021139.img.jpeg/1728622643931/fig28-ivanti-brute-force-tooling.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

2e50f9ae9324af2e1d1803215dfa3b1e4476f62bf1c3d548743835992ca87182

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "9326-6242c529632c0"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: l0rIFWxgfuURe6GyP1jELDEjtFLFWJBjZXZ9m3QuzvBDI9S-E3jFww==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:57:23 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37670
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig29-ivanti-content.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841266866.img.jpeg/1728622674435/ 23 KB
24 KB 129ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841266866.img.jpeg/1728622674435/fig29-ivanti-content.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

66a9e8a80c33a2f932441adf709f92aecca67782c8c0c5b1e165584d7eb3a291

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "5c88-6242c546f3880"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: _U-eoeRLj2YCN74j9a7pP5QbJJ5TjNTnVfmt0__whpD5X2YjuKLr7A==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:57:54 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 23688
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-csa-appliance.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_16445584.img.jpeg/1728622709083/ 41 KB
42 KB 128ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_16445584.img.jpeg/1728622709083/ivanti-csa-appliance.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

188c1c4378ca30c9eef2b446a37c4a7eb75d043f56acf32c35eb0077bb8705a6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "a328-6242c56854740"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: u5W6tkFTqHfJ0XUJmZo0hwbmRZMJ7ey-emigxy6KrDQ1j3RYujKrLA==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:58:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 41768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-php-variables.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_421608083.img.jpeg/1728622739558/ 35 KB
37 KB 128ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_421608083.img.jpeg/1728622739558/ivanti-php-variables.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f02faad1987312daa96dcd532794b6db4faa8a623306821b9d26235dbea36983

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "8df4-6242c584f0ac0"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: DH7PdE3gzwGgcK_s9SMX4Wc42DIXCSf7dK_fVmb_-ANFI_xxpf08Uw==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:58:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 36340
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-linux-kernel.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_38071269.img.jpeg/1728622775542/ 65 KB
66 KB 131ms
130ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_38071269.img.jpeg/1728622775542/ivanti-linux-kernel.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

644e98e4c6ce7519f77dc6c7401426d231c8f895f550c7f6c514bb4ec302ec6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10317-6242c5a745bc0"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: eZlf7ifm_xZlJcnUh6Tp8ApEp4wRi1tXhY-BmWPfKWIxM6tf154GYw==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:59:35 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 66327
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig30a-ivanti-base64.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1621469609.img.jpeg/1728622837198/ 171 KB
172 KB 129ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1621469609.img.jpeg/1728622837198/fig30a-ivanti-base64.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

39a543197cee3bd0cac857a39467717e59781b5a8eec38ba40ebcc281e2c78b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2ac3e-6242c5e266740"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: pbOwDgKAd9el81A-iUHguCiLmYI7AvnYDHKr8pzp44hPNblPoLeGHQ==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:00:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 175166
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig30b-malicious-tar-file-content.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1244035500.img.jpeg/1728622869372/ 14 KB
16 KB 129ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1244035500.img.jpeg/1728622869372/fig30b-malicious-tar-file-content.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

61af4356b1a56a808fbe79a6cd0f96444069b54d9eb1a1576b45c0e0f6bae0c5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "38ce-6242c600eaf40"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: l2S2urSsQ5ByczVeW-e-NJhlSy60I-EafHq0ROhgma9VtxsxmySRkg==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:01:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 14542
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig31-ivanti-rootkit-files.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_460351710.img.jpeg/1728622903847/ 20 KB
21 KB 129ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_460351710.img.jpeg/1728622903847/fig31-ivanti-rootkit-files.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

17234dc33fee83a6097588da7dc802864fd9af021ff0b48fa73a404e30aa362c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4f8f-6242c62157bc0"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: k3yeVx314l1wkRt6Cqp5e-2FrH2gNtYKRigNtS2BN6JUfTqLIGeNAA==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:01:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 20367
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-script-start-param.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1397322820.img.jpeg/1728622948264/ 79 KB
80 KB 134ms
133ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1397322820.img.jpeg/1728622948264/ivanti-script-start-param.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

72a16e82ebbe48c45ef6e2a67f4645444081d0cb72e09324824fc123fc30f6a0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "13afb-6242c64c42100"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: h4VIpIq8VTx4s9nEgC5bynxmReu3RXzzt9FUxKTCVPDyeltmLu3b0g==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:02:28 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d0c7523233c2ce4a1a420cfda612235a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 80635
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-script-second-param.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_281043642.img.jpeg/1728622982349/ 12 KB
14 KB 132ms
132ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_281043642.img.jpeg/1728622982349/ivanti-script-second-param.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f26ae51e214125767e456bc97f886b908749c984035ab7d7432fb11031a2a8e3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "31e8-6242c66caed80"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: mko0kKuzX5DPWkt_gdQFuPQ0XWBXW9yJNhOYOHKhlvvcwAJWTBsnTA==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:03:02 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 12776
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-code-snippet-path-exists.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1062228048.img.jpeg/1728623065236/ 31 KB
32 KB 129ms
129ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1062228048.img.jpeg/1728623065236/ivanti-code-snippet-path-exists.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

872f233ef34c09bfa33644108af6f2dfce8f77a0e2dc0847882840355efc4820

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ad4-6242c6bbd6840"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: axnQYKzNbM4lD3mubkL26Tg5KaZYii8dPc99g-4UKcGJ1tYqrpN8Cg==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:04:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31444
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig32-ivanti-installation-malicious-kernel.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_651532223.img.jpeg/1728623117727/ 23 KB
24 KB 129ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_651532223.img.jpeg/1728623117727/fig32-ivanti-installation-malicious-kernel.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a462bb85392ef235bc0ab080e8a9ae078a228fb74b3df156cb9f3ce7e20ad9e6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "5bd6-6242c6ed6dd40"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: VtVulP8HkPCi4jLbd2SGoKHZqC2ZA_VCFlJsTMpXgRWhXshdM8vNZA==
Date: Tue, 15 Oct 2024 13:02:53 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:05:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c09e1ee371c0b677b7724c2a52462928.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 23510
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig33-ivanti-establishing-rootkit.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_948091254.img.jpeg/1728623149502/ 67 KB
69 KB 128ms
128ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_948091254.img.jpeg/1728623149502/fig33-ivanti-establishing-rootkit.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

e91d19121fbf6ef08ec7ce270a07ef60a36ee454268228a0d698f666c2d9f359

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10d87-6242c70bf2540"
Age: 40873
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: hO7ygLtTkLOaB2HVsINDiKOjsj9zkr6PTdY2ZKFfO2vlG2JugfY7Aw==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:05:49 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 37b24eb2de6c1739f649810b6a7d81f8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 68999
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig34-ivanti-rootkit-persistence.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_89044911.img.jpeg/1728623190397/ 57 KB
58 KB 130ms
130ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_89044911.img.jpeg/1728623190397/fig34-ivanti-rootkit-persistence.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

931a1bc91c7b780d9df916bdbd551447e2b0d742a0ff1bdd7a6dbb5f42619b39

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "e339-6242c7330c180"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: -gBkg7Y_9uTmVxg7sEr97qnMcC1I3VeCWFyTI8ue4VKGIeNgQ6pnJQ==
Date: Tue, 15 Oct 2024 13:02:53 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:06:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 58169
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table04-ivanti-mitre-mapping.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_256695740.img.jpeg/1728661530772/ 94 KB
96 KB 130ms
130ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_256695740.img.jpeg/1728661530772/table04-ivanti-mitre-mapping.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a127f5d38a4a71d09b04fe89ab3c7cea05b5d20997a702855f66bcf3c0393cd5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "178fb-62435606eba80"
Age: 40873
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: oFmyzSoHsaiU5TlZmXxfqODmW54NN6lD0ObU1GP7sipHalFHkMVZqA==
Date: Tue, 15 Oct 2024 13:02:53 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 15:45:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 96507
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.10.0/ 356 KB
78 KB 83ms
83ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Bh9exWOPGIwRshWljrtlEw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735260901BC
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 68521
x-content-type-options: nosniff
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/javascript
last-modified: Thu, 03 Dec 2020 02:43:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 196e3d49-701e-0078-0644-149a7b000000
cf-ray: 8d30666f28917cf1-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 79698
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/3533a97f-12a7-47f0-84ae-9e6ba8ce15f2/ 100 KB
24 KB 92ms
92ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/3533a97f-12a7-47f0-84ae-9e6ba8ce15f2/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdb5dd11cc2d54154d78749eca731e4a7909d178949b5cfbed105545f8a5cfa6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: UsT1gPKoxJK6SWsWur7Vdw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF2C6D8622
age: 73208
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Wed, 16 Oct 2024 14:11:45 GMT
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/json
last-modified: Thu, 28 Dec 2023 19:57:08 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: ea968f81-801e-0088-1057-79dc8a000000
cf-ray: 8d3066702aa92b7a-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24105
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 13 KB
3 KB 99ms
95ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: W9e0YobmEbvdB0V9OmpQkw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735209A34D6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 78015
x-content-type-options: nosniff
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 9a92e17f-301e-0046-2672-790d04000000
cf-ray: 8d306670cb6f2b7a-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3329
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 45 KB
12 KB 91ms
88ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: zNsRoM1FEmsEgJoYMCNTng==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D897352245C4EA
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 82281
x-content-type-options: nosniff
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:53 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ecfe8c79-601e-0080-574e-79c685000000
cf-ray: 8d306670cb702b7a-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11755
x-ms-blob-type: BlockBlob
server: cloudflare

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 509 KB
122 KB 436ms
134ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 62ccea4549c1c360f561987e20bd929c475a5f596bc7731a224d99e0d253cfa0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "af0a8014ad3a875765ca4dd5d5ca9349:1728346478.684687"
expires: Tue, 15 Oct 2024 15:11:45 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 124284
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:38 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 id Show response
dpm.demdex.net/ 367 B
912 B 406ms
136ms XHR
application/json 18.209.0.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1729001505580

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.209.0.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-209-0-122.compute-1.amazonaws.com

Software

Resource Hash

b49d6ac6e025c44ccc97f72337d6484cb6e4ac502baed0f76a0415d90847e24e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v065-036e8df54.edge-va6.demdex.com 7 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: dgRYSOvaSHY=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.fortinet.com
content-length: 308
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 dest5.html
fortinet.demdex.net/ Frame 6600 0
0 499ms
125ms Document
text/html 44.209.251.198
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.209.251.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-209-251-198.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 15 Oct 2024 14:11:46 GMT
dcs: dcs-prod-va6-1-v065-0a7db7913.edge-va6.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 10 Oct 2024 08:49:47 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: E0U/0oYnQCE=

GET
H2

200

ibs:dpid=411&dpuuid=Zw54IgAAAHF-AANP
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=80879264112703762071257771742052073124
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zw54IgAAAHF-AANP

42 B
715 B

133ms
132ms

Image
image/gif

18.209.0.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zw54IgAAAHF-AANP

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Server

18.209.0.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-209-0-122.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v065-0d9c7cdeb.edge-va6.demdex.com 4 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: i+KIpIcNSBQ=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zw54IgAAAHF-AANP
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Tue, 15 Oct 2024 14:11:46 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

POST
H2 200 delivery Show response
fortinet.tt.omtrdc.net/rest/v1/ 351 B
837 B 518ms
145ms XHR
application/json 63.140.39.150
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.tt.omtrdc.net/rest/v1/delivery?client=fortinet&sessionId=e15c6229587b4d008b25e083709ee32b&version=2.10.0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.150 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-150.data.adobedc.net

Software

jag /

Resource Hash

f871c964f40da218d1b13f30f6bc5fa20910627b7a098971b587c163b09010c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 55d70627-7307-4fda-a720-1a1cdf802ca4
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://www.fortinet.com
date: Tue, 15 Oct 2024 14:11:46 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 35 KB
13 KB 137ms
137ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "d8232f86c8016a8e0acaa7ecfdf72b3e:1722493571.189276"
expires: Tue, 15 Oct 2024 15:11:46 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 13012
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 3 KB
2 KB 148ms
148ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "bb4b6453e3ab80111a2b227318d22efb:1722493571.614634"
expires: Tue, 15 Oct 2024 15:11:46 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1597
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 0786.js Show response
script.crazyegg.com/pages/scripts/0117/ 7 KB
3 KB 201ms
96ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eff032f2a7c04897a921492a9ce71e4fcbd047f1b2b487177955f000d6a182d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 88616
cf-polished: origSize=6996
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: text/javascript
last-modified: Mon, 14 Oct 2024 13:34:50 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d3066782c257e2a-SJC
access-control-allow-origin: *
ce-version: 11.5.299
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 421ms
132ms Script
application/javascript 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111bb"
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 17:11:46 GMT
accept-ranges: bytes
content-length: 18819
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 28 KB
9 KB 424ms
133ms Script
application/x-javascript 23.51.57.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.51.57.192 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-192.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3ac2943bf8d9d7f8d3dfa505f1c382b028fa493ffb2e3e2145595815df4ee999

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Content-Encoding: gzip
ETag: "f41d7dee86b46fd9726c83903f0d6cbe:1728888767.088324"
Connection: keep-alive
Expires: Tue, 15 Oct 2024 14:31:46 GMT
Accept-Ranges: bytes
X-CC: US
Content-Length: 8746
X-RG: NA
Date: Tue, 15 Oct 2024 14:11:46 GMT
Content-Type: application/x-javascript
Last-Modified: Mon, 14 Oct 2024 06:18:14 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 25f2dd15-02c6-4e7a-bc8b-c5722b49624d Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 408ms
134ms Script
application/javascript 34.86.110.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.86.110.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.110.86.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-request-id: F_6ltbQaM-5qX9RMtpCC
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 328ms
107ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

c3be590171c0375d497714a608a5c4cd4e90e124e1c0cff1807cd8adb156e64b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "01973e1111cdb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D8F374170AB94381A6045F07AE61FB3A Ref B: LAX311000108051 Ref C: 2024-10-15T14:11:46Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14538
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/javascript
last-modified: Fri, 11 Oct 2024 19:15:06 GMT
vary: Accept-Encoding

GET
H2 200 RCac955f2e1e97429197e1e31aaec22e86-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 1 KB
940 B 140ms
136ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCac955f2e1e97429197e1e31aaec22e86-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b0c24ca8333c5e792fdbb0d0a02529e99999ae19484c6e304c4cc8ce4535d485

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:46 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 683
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 9 KB
2 KB 136ms
132ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 450be4bf64305ebda12eebbbbdba85912e51497cbb52f921dab64a44310a16b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:46 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1844
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 358 B
483 B 138ms
134ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 608f95c0544308eaef8ee3554248e93e668f323fb954f584ddc12cd65947d251

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:46 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 227
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 703 B
683 B 139ms
136ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0d41c18875dbfc417ec3cdb20d698edd52b930504892fe1e3dd1c0f1ba9b42f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:46 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 426
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 365 KB
121 KB 460ms
178ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7e0efb4f74f81b4ffa6866d5f24a568e6f8c20f8f6d0af96a6ce7a295d851716

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 122805
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 RC06cd6a06a307489f80febc787462cb12-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 635 B
642 B 137ms
136ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC06cd6a06a307489f80febc787462cb12-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 90a224ae782e3be06cc08cd0dea598ea22f91ee4635920cc77228326bb5409d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:46 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 385
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/site/ 10 KB
2 KB 188ms
107ms XHR
application/json 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be6a4e807436b64099a97e3a4c3647c66628797d9de9c3f81140cdd2a2a798c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 88615
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/json
last-modified: Mon, 14 Oct 2024 13:34:51 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d3066794e7a67c7-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1804
ce-version: 11.5.299
server: cloudflare

GET
H2 200 17532650.js Show response
bat.bing.com/p/action/ 371 B
419 B 101ms
100ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17532650.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0e0c8cedb72a7e5a3080203509132486e267e5d1b0c5c6eae78ac16f7928ff01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6F66D86BC3274FFDA6FDB7C2711BF8A2 Ref B: LAX311000108051 Ref C: 2024-10-15T14:11:46Z
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 2780555e46c3031ae97407e9c52b4705.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 105 KB
36 KB 96ms
96ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61917dc4b13b887a30af978c934892e7db4329ba72bbd655635613b537d760e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 88616
cf-polished: origSize=107371
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: text/javascript
last-modified: Tue, 08 Oct 2024 19:20:03 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
cf-ray: 8d306679fdab7e2a-SJC
access-control-allow-origin: *
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 316 KB
105 KB 411ms
410ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

47e3fb300bd710551d6e3829db90920c956149275bf4ca5e43923ca256d8a384

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 107299
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK unifiedPixel Show response
tr.outbrain.com/ 53 B
321 B 440ms
143ms Fetch
image/gif 64.202.112.191
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?au=false&bust=016965945422757245&referrer=&cht=ot&marketerId=00ad3119690e692fd6990245f9741ea8f1&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&g=0&obApiVersion=1.1&obtpVersion=2.0.5

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

64.202.112.191 , United States, ASN23352 (SERVERCENTRAL, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 54
content-encoding: br
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: image/gif;
x-traceid: fd6e3be466a72e0210fae555f155c131

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 438ms
142ms Script
application/javascript 64.202.112.191
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

64.202.112.191 , United States, ASN23352 (SERVERCENTRAL, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 39
content-encoding: br
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: application/javascript
x-traceid: 33e338a70672e5e11f14edf91ffb326e

GET
H/1.1 200
OK 00ad3119690e692fd6990245f9741ea8f1 Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
516 B 413ms
133ms Script
text/html 23.51.57.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.51.57.192 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-51-57-192.deploy.static.akamaitechnologies.com

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
Cache-Control: max-age=60
ob-sent-time: 1728929156601
Content-Encoding: gzip
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Expires: Tue, 15 Oct 2024 14:12:47 GMT
Access-Control-Allow-Origin: *
X-CC: US
Content-Length: 22
X-RG: NA
Date: Tue, 15 Oct 2024 14:11:47 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
x-traceid: 865225c7c83eb871afc3c0543daf331a

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 397ms
133ms Fetch
text/html 23.51.57.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.51.57.192 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-192.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Connection: keep-alive
Observe-Browsing-Topics: ?1
Expires: Tue, 15 Oct 2024 14:31:47 GMT
Access-Control-Allow-Origin: *
X-CC: US
Content-Length: 26
X-RG: NA
Date: Tue, 15 Oct 2024 14:11:47 GMT
Content-Type: text/html

GET
H2 204 0
bat.bing.com/action/ 0
361 B 99ms
98ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=7b08b3bf-b4c3-4bf1-b297-3b6b77323c2a&bo=1&sid=69d9d2008aff11efbd78e5630e43c411&vid=69d9faa08aff11ef9d00f7c695d64b16&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&kw=FortiGuard%20Labs%20Threat%20Research,zero-day%20vulnerability&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&r=&lt=1019&pt=1729001503710,,,,,0,1,38,38,293,162,293,425,551,433,991,991,1019,,,&pn=0,0&evt=pageLoad&sv=1&cdb=AQET&rn=654774

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9AAAAC266BFF4AE1A651F837347D6EF0 Ref B: LAX311000108051 Ref C: 2024-10-15T14:11:46Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:45 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 150ms
132ms XHR
text/html 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-34-59-26.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.fortinet.com
content-length: 7
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 18 B
310 B 447ms
132ms XHR
text/html 2600:141b:1c00:2e::17d1:48c5
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:2e::17d1:48c5 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 8f908e9df5b54233e81476beca89f1587a0158cd77602fd1bf082d5ac6e054e4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2a04:c604:615:1::5
expires: Tue, 15 Oct 2024 14:11:47 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729001507226_399550033_389333035_14_574_130_157_219";dur=1
access-control-allow-origin: https://www.fortinet.com
content-length: 18
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 154ms
143ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A46%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 155ms
144ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2015%20Oct%202024%2014%3A11%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%225eeecf22b2d12a77a14639dce97b7a36%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2015%20Oct%202024%2014%3A11%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2015%20Oct%202024%2014%3A11%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2015%20Oct%202024%2014%3A11%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227381d1d7c753fe2d8e217c3fdc44c0f17418dcc4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2015%20Oct%202024%2014%3A11%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/sampling/ 46 B
297 B 89ms
89ms XHR
application/json 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/sampling/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29d6b32f545f36a29ab83a4be5f92d4ebfb43a6dcc6457f7681a8478e5e8ea6c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 88615
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: application/json
last-modified: Mon, 14 Oct 2024 13:34:52 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d30667bb82067c7-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 65
ce-version: 11.5.299
server: cloudflare

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 660 B
591 B 254ms
109ms XHR
application/json 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 1362ad7199ef6585442f4cb16faba76503e5cf440ca0a82490f19497cd6a75bc

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.fortinet.com
content-length: 331
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 257ms
78ms Preflight 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Tue, 15 Oct 2024 14:11:47 GMT
timing-allow-origin: https://6sense.com
x-6si-region

POST
H2 200 clock Show response
tracking.crazyegg.com/ 41 B
147 B 141ms
140ms XHR
text/plain 3.135.83.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1729001507216&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.135.83.200 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-135-83-200.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 924650c7a17eeebee4e6d6c734cdc04a1f259a2775cf53352f781d567798e60d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store
access-control-allow-origin: *
content-length: 41
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: text/plain
server: awselb/2.0

OPTIONS
H2 204 clock
tracking.crazyegg.com/ Frame 0
0 416ms
144ms Preflight 3.135.83.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1729001507216&tk=329ee1373036c5ddcda74cf257baa0a6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.135.83.200 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-135-83-200.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public, max-age=86400
date: Tue, 15 Oct 2024 14:11:47 GMT
server: awselb/2.0
vary: Access-Control-Request-Headers, Origin, Access-Control-Request-Method

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 256 KB
90 KB 191ms
189ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

86c482514cb9ce866c395eb8581dd77ec328b19bee3ed77a1c826f3bbdcdf1e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 15 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92507
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 176ms
174ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b6b5c482335d9f81dad2b8bc8e56fb1cf28c0a704f99de75ff04a334b5880355

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 15 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81410
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 237 KB
85 KB 170ms
169ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0568e0aa0121606c8b5c5a959e6b8e80560642d4748f059f0bae1aafabdb9265

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 15 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 87107
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 238ms
237ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

512c22cd351a348b420690acf963b4f4ccc9c39987a4cb03b4257311f502a209

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 15 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90152
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 430ms
146ms Fetch
text/plain 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-38BQ9XFDT4&gtm=45je4a90v9191763579za200&_p=1729001506457&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101686685&cid=246457897.1729001507&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1729001507&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&dt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=3728
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 47 KB
17 KB 476ms
175ms Script
application/javascript 2a02:6ea0:c454::1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-NY1-885 /
Resource Hash: 96fa0a3199b1184d9aab3b1a117e7b88974daff72641aee7f50b44f80d404aa4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "6707e1b1-bb6c"
cdn-fileserver: 749
date: Tue, 15 Oct 2024 14:11:47 GMT
cdn-storageserver: NY-346
last-modified: Thu, 10 Oct 2024 14:16:17 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 10/12/2024 23:29:28
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: ba7f3eb872fbd2d96bf6c93e0d2e2af6
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-triggerededgerule: a507b864-43b8-4277-b8aa-201eb3fa4d9d, 312b8174-53bc-4228-b69f-a97dfd5b1241, 312b8174-53bc-4228-b69f-a97dfd5b1241
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: US

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 143ms
141ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=ipv6&q=%7B%22address%22%3A%222a04%3Ac604%3A615%3A1%3A%3A5%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&ipv6=2a04%3Ac604%3A615%3A1%3A%3A5&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 5 KB
2 KB 434ms
163ms Script
text/javascript 142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1729001507651&cv=11&fst=1729001507651&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

cafe /

Resource Hash

743115747771d84320f952e1f7a97507b9fc3657cd03ad6c86164f197e7c0c4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2404
date: Tue, 15 Oct 2024 14:11:48 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 609297413
td.doubleclick.net/td/rul/ Frame 55B8 0
0 456ms
168ms Document
text/html 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/609297413?random=1729001507651&cv=11&fst=1729001507651&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=10050195;npa=0;auiddc=1369907835.1729001507;ps=1;pcor=1279793537;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=...
td.doubleclick.net/td/fls/rul/ Frame 1425 0
0 442ms
215ms Document
text/html 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=1369907835.1729001507;ps=1;pcor=1279793537;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;src=10050195;npa=0;auiddc=1369907835.1729001507;ps=1;pcor=1279793537;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1...
ad.doubleclick.net/ 42 B
65 B 357ms
202ms Image
image/gif 142.250.81.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;src=10050195;npa=0;auiddc=1369907835.1729001507;ps=1;pcor=1279793537;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Tue, 15 Oct 2024 14:11:48 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET activity;register_conversion=1;src=10050195;npa=0;auiddc=1369907835.1729001507;ps=1;pcor=1279793537;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb912...
ad.doubleclick.net/ 0
0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 43 B
61 B 304ms
157ms Script
text/javascript 142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1729001507778&cv=11&fst=1729001507778&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

cafe /

Resource Hash

77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 37
date: Tue, 15 Oct 2024 14:11:48 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 662878185
td.doubleclick.net/td/rul/ Frame 55B5 0
0 351ms
189ms Document
text/html 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/662878185?random=1729001507778&cv=11&fst=1729001507778&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/ 5 KB
2 KB 250ms
170ms Script
text/javascript 142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/?random=1729001507844&cv=11&fst=1729001507844&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.66 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

cafe /

Resource Hash

bbbe4c355190af010804b37a13086dbb5dc6cb763a70496d80946c978076693c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2403
date: Tue, 15 Oct 2024 14:11:48 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 729495989
td.doubleclick.net/td/rul/ Frame 7361 0
0 266ms
170ms Document
text/html 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/729495989?random=1729001507844&cv=11&fst=1729001507844&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 s26766357111404
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/ 43 B
372 B 433ms
130ms Image
image/gif 63.140.39.9
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/s26766357111404?AQB=1&ndh=1&pf=1&t=15%2F9%2F2024%204%3A11%3A47%202%20600&sdid=1265C4967D55C053-2F716B090C8272E6&mid=81222992427100023111293274871721860908&aamlh=7&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Aburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&c7=Entire%20Site&c8=New&v25=81222992427100023111293274871721860908&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Aburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&v106=Los%20Angeles&v107=California&v108=United%20States&v126=NA&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.9 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-9.data.adobedc.net

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
pragma: no-cache
etag: 3713002466562244608-4618233582630879624
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 14:11:48 GMT
access-control-allow-origin: *
p3p: CP="This is not a P3P policy"
content-length: 43
date: Tue, 15 Oct 2024 14:11:48 GMT
x-xss-protection: 1; mode=block
last-modified: Wed, 16 Oct 2024 14:11:48 GMT
vary: *
server: jag
content-type: image/gif;charset=utf-8

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 141ms
141ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A46%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%221004%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&ipv6=2a04%3Ac604%3A615%3A1%3A%3A5&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:48 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 api.min.css
a.omappapi.com/app/js/ 10 KB
3 KB 423ms
146ms Stylesheet
text/css 2a02:6ea0:c454::1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-NY1-885 /
Resource Hash: a4db214a51d8aa0b6a55aab329c983c0dba1976db88c499c75410392e220f9e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "6707e1c2-2644"
cdn-fileserver: 749
date: Tue, 15 Oct 2024 14:11:48 GMT
cdn-storageserver: NY-427
last-modified: Thu, 10 Oct 2024 14:16:34 GMT
content-type: text/css
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 10/12/2024 23:29:28
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 1
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: fae2bd91c42ff5937a133eb673133cd2
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: US

GET
H2 401 39852 Show response
api.omappapi.com/v2/embed/ 165 B
593 B 320ms
154ms XHR
application/json 2606:4700:3108::ac42:2af8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2af8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-user-agent: standard--
cf-cache-status: DYNAMIC
expires: Tue, 15 Oct 2024 14:12:38 GMT
x-cache: Error from cloudfront
x-amz-cf-id: --KM_sCxHXhTt5BpueNKvfzbm_sd6RiQEKIei8ZGyAvmNUPna2XQYw==
date: Tue, 15 Oct 2024 14:11:48 GMT
x-cache-config: 0 0
content-type: application/json
vary: Accept-Encoding, User-Agent
access-control-allow-headers: X-CSRF-Token
cache-control: public, max-age=120, stale-while-revalidate=1800
via: 1.1 4b30b878248a1dcea5520c8b5eca966a.cloudfront.net (CloudFront)
cf-ray: 8d3066825b152f04-LAX
access-control-allow-origin: *
content-length: 165
x-amz-cf-pop: LAX50-P5
server: cloudflare

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 293ms
128ms Script
text/javascript 2606:4700::6812:1347
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1347 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 24346
via: 1.1 google
cf-ray: 8d3066825c060fff-LAX
expires: Tue, 15 Oct 2024 14:31:48 GMT
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK tag.js Show response
abm-tracking.demandscience.com/ 2 KB
2 KB 313ms
100ms Script
application/javascript 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/tag.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: public, max-age=0
ETag: W/"82b-18f5d3a3d78"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2091
Date: Tue, 15 Oct 2024 14:11:48 GMT
Content-Type: application/javascript; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Thu, 09 May 2024 12:00:49 GMT

GET
H2 200 wid.tracker.js Show response
tmp.argusplatform.com/js/ 8 KB
3 KB 488ms
213ms Script
text/javascript 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://tmp.argusplatform.com/js/wid.tracker.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preloadmax-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preloadmax-age=31536000
cache-control: public, must-revalidate, max-age=30
x-dns-prefetch-control: off
content-encoding: br
etag: "28476869"
referrer-policy: same-origin
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:48 GMT
x-xss-protection: 1; mode=block
content-type: text/javascript
last-modified: Sat, 08 Jun 2024 11:51:22 GMT
vary: Accept-Encoding
x-azure-ref: 20241015T141148Z-17b8d69fbb599jhx8166ab35pw000000078g00000000tkxu

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ 161 B
710 B 415ms
134ms Script
text/javascript 74.121.140.211
PAEDAE-INC

General

Check archive.org

Show headers Download Go to

Full URL

https://pixel.mathtag.com/event/js?mt_id=1629896&mt_adid=260855&mt_exem=&mt_excl=&v2=&v3=&s1=&s2=&s3=&v1=en:blog:threat-research:burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.121.140.211 Reston, United States, ASN30419 (PAEDAE-INC, US),

Reverse DNS

Software

MT3 1668 f41eadd master iad iad-pixel-x4 config_version:"380" /

Resource Hash

98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457

Security Headers

Name	Value
Strict-Transport-Security	31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Strict-Transport-Security: 31536000
Cache-Control: no-cache
Content-Encoding: gzip
Connection: close
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Tue, 15 Oct 2024 14:11:48 GMT
X-XSS-Protection: 0
Content-Type: text/javascript
Server: MT3 1668 f41eadd master iad iad-pixel-x4 config_version:"380"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 323 KB
107 KB 183ms
183ms Script
application/javascript 142.250.80.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.104 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

7001f8d67c0a19ca456ca7dd12a3e4d139d9a3e2199d7e6f77c38f7929b8fb78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 109447
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK footer-links.json Show response
www.fortinet.com/content/dam/fortinet-blog/ 310 KB
36 KB 131ms
130ms XHR
application/json 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/footer-links.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "4d8dc-61d89b0f78340-gzip"
Age: 7674400
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: RihvpP808GMZVVwkA-BdmyM-JWy7kpNto4XTrO9Td_IRchekDpBsNw==
Date: Tue, 15 Oct 2024 00:12:10 GMT
Content-Type: application/json
Vary: Accept-Encoding
Last-Modified: Thu, 18 Jul 2024 18:24:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35378
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H3 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
64 B 428ms
153ms Image
image/gif 142.250.65.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1729001507651&cv=11&fst=1729000800000&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfFx85o8bFPouAWOtiPOKC2B46KNQgAQ&random=845612025&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.228 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 15 Oct 2024 14:11:48 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/729495989/ 42 B
64 B 425ms
158ms Image
image/gif 142.250.65.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/729495989/?random=1729001507844&cv=11&fst=1729000800000&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1369907835.1729001507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfbJr4XLrm_sUYleA1h6Gblnutsiq2rw&random=1828122096&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.228 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 15 Oct 2024 14:11:48 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 291ms
142ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1729001508311&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 15 Oct 2024 14:11:48 GMT
expires: Tue, 15 Oct 2024 14:11:48 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AHmUCY1OIM-2oBsmOGzY47ztR2A9KjVqsKHuUT_-VMymi1ctHhlanJnIS2moyvADGJ1TB5FlWKailL0lwQ

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
447 B 153ms
151ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1729001508311&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
ibc_rate_tier: 1247773
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Tue, 15 Oct 2024 15:11:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AHmUCY2uRMbid2zTuRSSrVbDadwjfJwOm7x6zy9MIQ1SX3ILhx6ir5TxnA6k4CqM1usTJdf0HTjwk1JfSw
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

GET
H2 200 fp.min.js Show response
cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/ 33 KB
14 KB 212ms
70ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY"
age: 1118
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220049-FRA, cache-lax-kwhp1940025-LAX
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13749
x-jsd-version: 3.4.2

GET
H2 200 site-visitors Show response
intentstream.contanuity.com/api/ 115 B
374 B 100ms
99ms Fetch
application/json 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-pixel-auth: true
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=15724800; includeSubdomains
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 115
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/json; charset=utf-8
vary: origin
server: nginx

OPTIONS
H2 200 site-visitors
intentstream.contanuity.com/api/ Frame 0
0 301ms
99ms Preflight 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-pixel-auth
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-pixel-auth
access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
content-length: 0
date: Tue, 15 Oct 2024 14:11:48 GMT
server: nginx
strict-transport-security: max-age=15724800; includeSubdomains

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 151ms
149ms Fetch
text/plain 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-JH142QCQCJ&gtm=45je4a90v893708426za200zb9123037237&_p=1729001506457&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101686685&cid=246457897.1729001507&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1729001508&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&dt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_ss=1&_ee=1&tfd=4821
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: text/plain
server: Golfe2

GET
H2 401 / Show response
pixels.argusplatform.com/wh/track/ 205 B
468 B 857ms
600ms XHR
application/json 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1729001509210137504&event_type=page_request&timestamp=1729001509&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20241015T141148Z-17b8d69fbb5s5r4b96p3d6sgfs00000008rg00000000m4sx

GET
H2 200 RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 2 KB
1011 B 138ms
135ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 03a0fcddc62f902b243bb6ed855041f4fa937340fd81d86552f672f24d6497da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 754
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7be3d22b2fd6487ca9390477738587fe-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 819 B
756 B 139ms
136ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC7be3d22b2fd6487ca9390477738587fe-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0d87642c368aa398fe4dd35af439768fb2c9167ba52f2b995eaa3d61598853a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC407b573180554ea6b11eecdc31ecbd3f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 819 B
756 B 141ms
134ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC407b573180554ea6b11eecdc31ecbd3f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5f7c381eca2f132069a8514789e46793cf6f5886b523ac91db7e33c41182248d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 499
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC8c594cd344f84ab89afc779d8f53fff4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 1 KB
811 B 139ms
133ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC8c594cd344f84ab89afc779d8f53fff4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2e963b4b8f73348a8de67ca3f24258b1bfc6874339867af3119bd8751ad9db79

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 554
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5915f5d7e33546579cd5fd510349ed90-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 722 B
715 B 146ms
141ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC5915f5d7e33546579cd5fd510349ed90-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 55efcd9c7c8dc07e65a641a23760facd1b95fa530876ac2d2766e3247764ad3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 458
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC1d92f04752ae42a38e54de48cb85adf4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 661 B
648 B 140ms
135ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC1d92f04752ae42a38e54de48cb85adf4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 661e67a6ed119b9a5bd08892caf68b0e794f68207156cd50f703d320ee6155ef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 391
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf940460311f349b5af69d075bdef61d4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 368 B
491 B 145ms
140ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCf940460311f349b5af69d075bdef61d4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c153cd2dff5ec3af05397a2fe0f7dc1eb7544b5858521dca8bf1c20e439d70d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 234
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 754 B
704 B 141ms
137ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f46a9869eb1b18c3d0274a6ab46008bb2cfaa73cc3fbb25df8e2d6085ad706da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 447
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 2 KB
970 B 139ms
135ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1bfc3fec636bdfc92ca324c43dc9382d5f1567b0cb29f806202c2ee530173b7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 713
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 1021 B
856 B 141ms
136ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8c0aa54f351ccf9f614ac7519cec00ae1f40db7bbea8c7dd2fb51538a8d9b272

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 600
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcd84e40d19c24776bef77836ab2f8df6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 819 B
757 B 272ms
269ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4e9aa67ca1f1ffe2c11e722079a58f1be803c9378468d6c019be53b1ffd26c6b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 501
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 388 B
498 B 265ms
262ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9636ce7f4b06bd40058b0417691448095e6490a3b518fbdeac3e104023fd9b92

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 242
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5c60a51709a94068afbf065e1448b617-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 664 B
656 B 264ms
261ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC5c60a51709a94068afbf065e1448b617-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c50c3a763973b8bc75e126c3f104f84a728f8febf50faa7e37685e86fa1e2c1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 400
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 2 KB
981 B 265ms
263ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a23b68a0964626bb4062bf726dd4ab52d438dcfb88991402b224146d1087d1a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 724
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 966 B
808 B 264ms
262ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 18e04370c6f2bee61d32771663e6b0408e1627bb89a3894457941fa19ad83000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:48 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 551
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 p Show response
i.simpli.fi/ 798 B
762 B 140ms
131ms Script
application/javascript 34.86.110.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp
Requested by: Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.86.110.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.110.86.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: ccb5e7cd791c0fe26d7130402378ba7ac7de583a93285ec5258535eb1aef114a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: openresty

GET
H/1.1 200
OK favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/ 318 B
2 KB 131ms
130ms Other
image/vnd.microsoft.icon 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "13e-565c628eb6a00-gzip"
Age: 1011556
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: odRzMcJpLg2yOGYFLul3P4BJO2sFsUHm5fr-3CkgBMzpql-hOT-elA==
Date: Fri, 04 Oct 2024 00:09:26 GMT
Content-Type: image/vnd.microsoft.icon
Last-Modified: Thu, 22 Feb 2018 05:17:28 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 0431e23c0344851eeb0c8f1f10c6edc4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 133
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa Show response
abm-tracking.demandscience.com/page-tracking/fortinet_2712/ 2 B
665 B 103ms
101ms Script
application/json 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/page-tracking/fortinet_2712/https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?visitorId=0ac9c017dfdd772893a32ead8dfce3c5_1729001508702&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Tue, 15 Oct 2024 14:11:48 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H/1.1 200
OK spx Show response
dx.mountain.com/ 23 KB
6 KB 549ms
140ms Script
application/javascript 44.209.137.118
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=95504005523385470term=value
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.209.137.118 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-209-137-118.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: d149f99e38895c0c719de767174e8936f8086a90dffde561e2db9f40f735c345

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 2
expires: Thu, 01 Jan 1970 00:00:00 GMT
be: spx-prod
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/javascript;charset=utf-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: istio-envoy

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 426ms
135ms Script
application/javascript 151.101.44.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.44.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Tue, 15 Oct 2024 14:11:49 GMT
x-tw-cdn: FT
last-modified: Thu, 04 Apr 2024 00:26:35 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kcgs7200164-IAD, cache-nyc-kteb1890049-NYC
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 416ms
140ms Script
application/javascript 2600:141b:1c00:6::17df:d120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:6::17df:d120 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=69855
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Tue, 15 Oct 2024 14:11:49 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 22 KB
7 KB 398ms
128ms Script
text/javascript 34.196.140.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.140.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-140-205.compute-1.amazonaws.com
Software: /
Resource Hash: df2ea3183c9d9074c41a16483a9b0ac48c0d60b41657de1ded16c7743313f8fd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: max-age=5
content-encoding: gzip
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/javascript

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1773420&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

43 B
1 KB

141ms
139ms

Image
image/gif

68.67.179.164
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Protocol

Server

68.67.179.164 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: a7f37d64-9480-483e-a523-a5de3af30bc6
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:49 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.244; 162.245.206.244; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 061f4f30-dffe-4b3a-bd36-761d2ac9d311
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:49 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?add=36113683
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

43 B
1 KB

141ms
140ms

Image
image/gif

68.67.181.211
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Protocol

Server

68.67.181.211 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 96fad2df-abef-4155-b46f-92475f01c006
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:49 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 9d199039-8db0-4720-9ce2-233c82e35f78
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:49 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 iztag.js Show response
tags.inzynk.io/0ulh3gex/ 34 B
442 B 469ms
129ms Script
application/octet-stream 2600:9000:2512:3a00:12:dfa9:e200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.inzynk.io/0ulh3gex/iztag.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2512:3a00:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding
x-amz-version-id: 15XT7F8rursoJ6jHrhKIXrYdXTZkWasY
etag: "595f7fa79bc22a7029d2751228622eb4"
age: 75064
via: 1.1 7c1248297a08764c17a9223ad5c211f8.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 34
x-amz-cf-id: 9N7ZjIZ_QvEOoWsjRaC2koyKyCLgLLpXwbsQ_OjOQSM9mVK2RBeubA==
date: Mon, 14 Oct 2024 17:21:30 GMT
content-type: application/octet-stream
last-modified: Thu, 05 Sep 2024 13:11:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P7
x-amz-server-side-encryption: AES256

GET

/
s.ad.smaato.net/c/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=613CCCB341A147B5857B261E2C187A9E

0
0

GET
H2

204

613CCCB341A147B5857B261E2C187A9E
sync.1rx.io/usersync/simplifi/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/613CCCB341A147B5857B261E2C187A9E

0
99 B

399ms
131ms

Image
text/plain

69.194.240.13
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.1rx.io/usersync/simplifi/613CCCB341A147B5857B261E2C187A9E
Protocol: H2
Server: 69.194.240.13 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
date: Tue, 15 Oct 2024 14:11:46 GMT
pragma: no-cache

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.1rx.io/usersync/simplifi/613CCCB341A147B5857B261E2C187A9E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 14 Oct 2024 14:11:49 GMT
access-control-allow-origin: *
content-length: 142
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=613CCCB341A147B5857B261E2C187A9E&dongle=yf3
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=613CCCB341A147B5857B261E2C187A9E&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

37 B
472 B

151ms
150ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=613CCCB341A147B5857B261E2C187A9E&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: /xuid?ld=1&mid=7969&xuid=613CCCB341A147B5857B261E2C187A9E&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Tue, 15 Oct 2024 14:11:49 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=613CCCB341A147B5857B261E2C187A9E

43 B
175 B

408ms
126ms

Image
image/gif

2600:1f18:612b:4264:4138:d6ea:f3b0:2f1c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=613CCCB341A147B5857B261E2C187A9E
Protocol: H2
Server: 2600:1f18:612b:4264:4138:d6ea:f3b0:2f1c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://simplifi.partners.tremorhub.com/sync?UISF=613CCCB341A147B5857B261E2C187A9E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 14 Oct 2024 14:11:49 GMT
access-control-allow-origin: *
content-length: 142
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=613CCCB341A147B5857B261E2C187A9E
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=613CCCB341A147B5857B261E2C187A9E

95 B
426 B

118ms
117ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=613CCCB341A147B5857B261E2C187A9E

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=613CCCB341A147B5857B261E2C187A9E
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Tue, 15 Oct 2024 14:11:49 GMT
server: Jetty(11.0.13)

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=613CCCB341A147B5857B261E2C187A9E
https://d.agkn.com/pixel/10751/?che=1729001509684&ip=162.245.206.244&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D213610605036309356329
https://um.simpli.fi/aa_px?sk=213610605036309356329
https://um.simpli.fi/empty.gif

43 B
361 B

129ms
128ms

Image
image/gif

35.194.66.159
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

35.194.66.159 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

159.66.194.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 43
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
location: /empty.gif
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 142
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=613CCCB341A147B5857B261E2C187A9E
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=613CCCB341A147B5857B261E2C187A9E&ckls=true&ci=yHGn5YxzMg&nc=false&trid=-1147361809

43 B
1 KB

248ms
246ms

Image
image/gif

2600:9000:26fa:a400:1b:6b7d:2300:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=613CCCB341A147B5857B261E2C187A9E&ckls=true&ci=yHGn5YxzMg&nc=false&trid=-1147361809
Protocol: H2
Server: 2600:9000:26fa:a400:1b:6b7d:2300:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 39cd5ffcd7df50a48d03f7c7f50d3d1a.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length: 43
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P1
x-amz-cf-id: 19RUdM2K-6ewETGT3G86oGp1rx4v7hvPQPGxfQZXZRgAYU4Gpdb-tw==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=613CCCB341A147B5857B261E2C187A9E&ckls=true&ci=yHGn5YxzMg&nc=false&trid=-1147361809
pragma: no-cache
via: 1.1 39cd5ffcd7df50a48d03f7c7f50d3d1a.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P1
x-amz-cf-id: MJoPJvS9EjeKLzeJCpXNudsgDWcyK9h_1vvySMBPXVyXcopBYbVsSw==

GET
H2

200

Pug
image2.pubmatic.com/AdServer/
Redirect Chain

https://um.simpli.fi/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:613CCCB341A147B5857B261E2C187A9E

42 B
551 B

406ms
129ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:613CCCB341A147B5857B261E2C187A9E
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:613CCCB341A147B5857B261E2C187A9E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 14 Oct 2024 14:11:49 GMT
access-control-allow-origin: *
content-length: 142
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200

user-registering
ads.stickyadstv.com/
Redirect Chain

https://um.simpli.fi/freewheel
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=613CCCB341A147B5857B261E2C187A9E

43 B
653 B

589ms
144ms

Image
image/gif

63.251.28.210
FREEWHEEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=613CCCB341A147B5857B261E2C187A9E
Protocol: HTTP/1.1
Server: 63.251.28.210 Secaucus, United States, ASN26558 (FREEWHEEL, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
x-sticky-vk: 1729001509802085-67
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Date: Tue, 15 Oct 2024 14:11:49 GMT
Content-Type: image/gif
Server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=613CCCB341A147B5857B261E2C187A9E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 14 Oct 2024 14:11:49 GMT
access-control-allow-origin: *
content-length: 142
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

getuid
sync.smartadserver.com/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=613CCCB341A147B5857B261E2C187A9E;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=613CCCB341A147B5857B261E2C187A9E;mimetype=img;sr
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Ffei.pro-market.net%2Fengine%3Fsite%3D161185%26size%3D1x1%26du%3D36%26csync%3D[sas_uid]
https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1

0
316 B

129ms
128ms

Image
text/plain

23.105.12.120
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
Protocol: HTTP/1.1
Server: 23.105.12.120 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Tue, 15 Oct 2024 14:11:50 GMT
pragma: no-cache

Redirect headers

cache-control: no-cache,no-store
location: https://sync.smartadserver.com:443/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Tue, 15 Oct 2024 14:11:49 GMT
pragma: no-cache

GET

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=613CCCB341A147B5857B261E2C187A9E&j=0

0
0

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55964/
Redirect Chain

https://um.simpli.fi/yahoo
https://ups.analytics.yahoo.com/ups/55964/sync?uid=613CCCB341A147B5857B261E2C187A9E
https://ups.analytics.yahoo.com/ups/55964/sync?uid=613CCCB341A147B5857B261E2C187A9E&verify=true

0
130 B

140ms
131ms

Image
text/html

34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55964/sync?uid=613CCCB341A147B5857B261E2C187A9E&verify=true

Protocol

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-200-65-202.compute-1.amazonaws.com

Software

ATS/9.1.10.137 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Tue, 15 Oct 2024 14:11:49 GMT
age: 0
content-type: text/html
server: ATS/9.1.10.137

Redirect headers

strict-transport-security: max-age=31536000
location: https://ups.analytics.yahoo.com/ups/55964/sync?uid=613CCCB341A147B5857B261E2C187A9E&verify=true
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
content-length: 0
date: Tue, 15 Oct 2024 14:11:49 GMT
age: 0
server: ATS/9.1.10.137

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=613CCCB341A147B5857B261E2C187A9E

0
421 B

534ms
136ms

Image
text/plain

34.193.229.172
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=613CCCB341A147B5857B261E2C187A9E
Protocol: HTTP/1.1
Server: 34.193.229.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-229-172.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Date: Tue, 15 Oct 2024 14:11:49 GMT
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.bfmio.com/sync?pid=141&uid=613CCCB341A147B5857B261E2C187A9E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 14 Oct 2024 14:11:49 GMT
access-control-allow-origin: *
content-length: 142
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

500
Internal Server Error

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=613CCCB341A147B5857B261E2C187A9E

27 B
27 B

446ms
142ms

Image
text/html

184.50.205.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=613CCCB341A147B5857B261E2C187A9E
Protocol: HTTP/1.1
Server: 184.50.205.247 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-205-247.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5607bc0b49036b5f13acf3f5767e0fb2fb947f5369bda253939e78e2b11f85b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Tue, 15 Oct 2024 14:11:49 GMT
Content-Length: 27
Date: Tue, 15 Oct 2024 14:11:49 GMT
AK-GRN: 0.15f2da17.1729001509.220436cc
Content-Type: text/html

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://stags.bluekai.com/site/29931?id=613CCCB341A147B5857B261E2C187A9E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 14 Oct 2024 14:11:49 GMT
access-control-allow-origin: *
content-length: 142
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

tpid=613CCCB341A147B5857B261E2C187A9E
bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=613CCCB341A147B5857B261E2C187A9E
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=613CCCB341A147B5857B261E2C187A9E

49 B
543 B

165ms
160ms

Image
image/gif

44.215.158.120
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=613CCCB341A147B5857B261E2C187A9E
Protocol: H2
Server: 44.215.158.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-215-158-120.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif
x-server: 10.40.60.87
server: Jetty(9.4.38.v20210224)

Redirect headers

cache-control: no-cache
location: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=613CCCB341A147B5857B261E2C187A9E
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Tue, 15 Oct 2024 14:11:49 GMT
x-server: 10.40.53.253
server: Jetty(9.4.38.v20210224)

GET
H2

200

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=613CCCB341A147B5857B261E2C187A9E
https://ce.lijit.com/merge?pid=2&3pid=613CCCB341A147B5857B261E2C187A9E&dnr=1

43 B
511 B

165ms
163ms

Image
image/gif

52.6.142.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=613CCCB341A147B5857B261E2C187A9E&dnr=1
Protocol: H2
Server: 52.6.142.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-142-3.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://ce.lijit.com/merge?pid=2&3pid=613CCCB341A147B5857B261E2C187A9E&dnr=1
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 15 Oct 2024 14:11:49 GMT
vary: Accept-Encoding

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=613CCCB341A147B5857B261E2C187A9E
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogNjEzQ0NDQjM0MUExNDdCNTg1N0IyNjFFMkMxODdBOUUQABoNCKXwubgGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=2b3f7fbcb9a33575d4861409f0de9a7208aeb8b64ddf7f3ba430b48d094c75ea791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=2b3f7fbcb9a33575d4861409f0de9a7208aeb8b64ddf7f3ba430b48d094c75ea791426b5417dce21&rand=01523604

0
143 B

166ms
163ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=2b3f7fbcb9a33575d4861409f0de9a7208aeb8b64ddf7f3ba430b48d094c75ea791426b5417dce21&rand=01523604
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 334ACBE624C047C99D292300C11D18C1 Ref B: LAX311000112031 Ref C: 2024-10-15T14:11:50Z
x-li-fabric: prod-lva1
x-li-uuid: AAYkhIjTHtGqpam+cufkIQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 15 Oct 2024 14:11:49 GMT

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=2b3f7fbcb9a33575d4861409f0de9a7208aeb8b64ddf7f3ba430b48d094c75ea791426b5417dce21&rand=01523604
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Tue, 15 Oct 2024 14:11:49 GMT

GET
H3

200

/
www.google.com/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1729001508643&cv=7&fst=1729001508643&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=613363999&cv=7&fst=1729001508643&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHB...
https://www.google.com/pagead/1p-conversion/1026675585/?random=613363999&cv=7&fst=1729001508643&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDs...

42 B
64 B

165ms
163ms

Image
image/gif

142.250.65.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/1026675585/?random=613363999&cv=7&fst=1729001508643&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybEC&pscrd=IhMI68ChxsiQiQMVPDnQBB1tKwfxMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfjFmNuqwm8Yahizac7To4P_dy1ihuoI3qj8I3f_8wssjYqwqL&random=3920053569

Protocol

Server

142.250.65.228 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 15 Oct 2024 14:11:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://www.google.com/pagead/1p-conversion/1026675585/?random=613363999&cv=7&fst=1729001508643&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybEC&pscrd=IhMI68ChxsiQiQMVPDnQBB1tKwfxMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfjFmNuqwm8Yahizac7To4P_dy1ihuoI3qj8I3f_8wssjYqwqL&random=3920053569
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Tue, 15 Oct 2024 14:11:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 153ms
147ms Image
text/plain 35.194.66.159
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.194.66.159 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

159.66.194.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin: *
date: Tue, 15 Oct 2024 14:11:49 GMT
x-content-type-options: nosniff

GET
H2

200

setuid
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=613CCCB341A147B5857B261E2C187A9E

43 B
1 KB

140ms
135ms

Image
image/gif

68.67.181.211
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=66&code=613CCCB341A147B5857B261E2C187A9E

Protocol

Server

68.67.181.211 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.244; 162.245.206.244; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 63fb4338-65ff-4c29-8894-08b99b37a131
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:49 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ib.adnxs.com/setuid?entity=66&code=613CCCB341A147B5857B261E2C187A9E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 14 Oct 2024 14:11:49 GMT
access-control-allow-origin: *
content-length: 142
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=613CCCB341A147B5857B261E2C187A9E&expires=365

42 B
1 KB

569ms
138ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=613CCCB341A147B5857B261E2C187A9E&expires=365
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=613CCCB341A147B5857B261E2C187A9E&expires=365
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 14 Oct 2024 14:11:49 GMT
access-control-allow-origin: *
content-length: 142
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=613CCCB341A147B5857B261E2C187A9E
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=613CCCB341A147B5857B261E2C187A9E

43 B
171 B

119ms
118ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=613CCCB341A147B5857B261E2C187A9E
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif
vary: Accept
server: OXGW/0.0.0

Redirect headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=613CCCB341A147B5857B261E2C187A9E
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 0
date: Tue, 15 Oct 2024 14:11:49 GMT
server: OXGW/0.0.0

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_error=15

0
320 B

133ms
133ms

Image
text/plain

35.194.66.159
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=&google_error=15

Protocol

Server

35.194.66.159 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

159.66.194.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 14:11:49 GMT
access-control-allow-origin: *
date: Tue, 15 Oct 2024 14:11:49 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

cache-control: no-cache, must-revalidate
location: https://um.simpli.fi/g_match?id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 249
date: Tue, 15 Oct 2024 14:11:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 189 KB
68 KB 172ms
171ms Script
application/javascript 142.250.80.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4NSPPXN

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.104 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c86f2ad57b3a3d9647b3415383ed7d8426619fec423e97629abefe8351a505bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Tue, 15 Oct 2024 14:11:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 15 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 69312
x-xss-protection: 0
server: Google Tag Manager

GET
BLOB 200
OK cda48bd8-8c90-479e-b95c-9551987873e0
https://www.fortinet.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.fortinet.com/cda48bd8-8c90-479e-b95c-9551987873e0
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H/1.1 200
OK tracking Show response
tracking.contanuity.com/ 2 B
769 B 308ms
99ms Script
application/json 54.203.236.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.contanuity.com/tracking?visitorId=0ac9c017dfdd772893a32ead8dfce3c5_1729001508702&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.203.236.163 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-203-236-163.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Tue, 15 Oct 2024 14:11:49 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 143ms
142ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A47%20GMT%22%2C%22timeSpent%22%3A%221019%22%2C%22totalTimeSpent%22%3A%222023%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&ipv6=2a04%3Ac604%3A615%3A1%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:49 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 130ms
125ms Stylesheet
text/css 34.196.140.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.140.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-140-205.compute-1.amazonaws.com
Software: /
Resource Hash: 7b8112efa2e817f2534339b1a48bf487e65a54d6e3c17ac91c61b7bfb396dc5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 376ms
126ms Fetch
image/jpeg 34.196.140.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.140.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-140-205.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/jpeg

GET
H2 200 adsct
t.co/i/ 43 B
625 B 284ms
134ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=3f768542-a0d3-49d2-91d8-00caffc1b22d&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7e59861b-3dbc-4189-a49d-35f95299b191&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 48ec258b1f0b32ad
cache-control: no-cache, no-store, max-age=0
x-connection-hash: b432478a58237b74c9df25c02063380a993340b4a48507c88aee8e835ebb4a45
cf-cache-status: DYNAMIC
cf-ray: 8d30668a1eca319d-LAX
x-response-time: 6
content-length: 43
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_p

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
214 B 304ms
104ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=3f768542-a0d3-49d2-91d8-00caffc1b22d&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7e59861b-3dbc-4189-a49d-35f95299b191&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: d25c03938ca35fbe
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 2a818bb6139cdeaa535ca6e25c9179cb3b820072e4bde1ca419aa775b04a65c2
x-response-time: 7
content-length: 43
date: Tue, 15 Oct 2024 14:11:48 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_p

GET
H2 200 adsct
t.co/i/ 43 B
463 B 224ms
135ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=463be315-de83-45d2-99ca-3aa6f33ba429&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7e59861b-3dbc-4189-a49d-35f95299b191&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: a1043435aea8cc02
cache-control: no-cache, no-store, max-age=0
x-connection-hash: b0b373b86d5d91f57c0eec200d743d580a1bf833f7c2f371f07a162b400568de
cf-cache-status: DYNAMIC
cf-ray: 8d30668a1ecc319d-LAX
x-response-time: 6
content-length: 43
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_p

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
391 B 264ms
103ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=463be315-de83-45d2-99ca-3aa6f33ba429&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7e59861b-3dbc-4189-a49d-35f95299b191&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: c4ede26f361a1312
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 2a818bb6139cdeaa535ca6e25c9179cb3b820072e4bde1ca419aa775b04a65c2
x-response-time: 5
content-length: 43
date: Tue, 15 Oct 2024 14:11:48 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_p

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
763 B 298ms
144ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.fortinet.com/

Response headers

x-li-pop: afd-prod-lva1-x
content-encoding: gzip
x-fs-uuid: 0006248488c88fcf6830bf05f3770522
x-msedge-ref: Ref A: 6ECF053CFF8B4F94A93798540E3F1A13 Ref B: LAXEDGE1619 Ref C: 2024-10-15T14:11:49Z
x-li-fabric: prod-lva1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYkhIjIj89oML8F83cFIg==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&li_adsId=92114b72-59db-45a7-91f3-0be6fa2ace23&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&li_adsId=92114b72-59db-45a7-91f3-0be6fa2ace23&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%252C6313418%26time%3D1729001509173%26li_adsId%3D9211...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&li_adsId=92114b72-59db-45a7-91f3-0be6fa2ace23&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&li_adsId=92114b72-59db-45a7-91f3-0be6fa2ace23&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Ft...

0
489 B

410ms
249ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&li_adsId=92114b72-59db-45a7-91f3-0be6fa2ace23&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cookiesTest=true&liSync=true&e_ipv6=AQJv9EQWX805GgAAAZKQhVThgIMwtdgeiuOPT2YIrEZ702GuejRN2voGH440coBr625pXg
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 07B02A3CF5EC4C378082B5626509C6A9 Ref B: LAX311000112021 Ref C: 2024-10-15T14:11:50Z
x-li-fabric: prod-lva1
x-li-uuid: AAYkhIjZyjK0NEaTgrfExQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001509173&li_adsId=92114b72-59db-45a7-91f3-0be6fa2ace23&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cookiesTest=true&liSync=true&e_ipv6=AQJv9EQWX805GgAAAZKQhVThgIMwtdgeiuOPT2YIrEZ702GuejRN2voGH440coBr625pXg
x-msedge-ref: Ref A: 4297AFE90A934EAEBC358F592135636F Ref B: LAX311000112031 Ref C: 2024-10-15T14:11:50Z
x-li-fabric: prod-lva1
x-li-uuid: AAYkhIjTc5FfwPaCjsLfUA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 15 Oct 2024 14:11:49 GMT

GET
H2

200

burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3435340...
10104846.fls.doubleclick.net/activityi;dc_pre=CPCbscbIkIkDFamqjggdyt0dHQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/ Frame 3A18
Redirect Chain

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-iva...
https://10104846.fls.doubleclick.net/activityi;dc_pre=CPCbscbIkIkDFamqjggdyt0dHQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-...

0
0

244ms
233ms

Document
text/html

172.217.165.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10104846.fls.doubleclick.net/activityi;dc_pre=CPCbscbIkIkDFamqjggdyt0dHQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3435340169617.6313?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s70-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 2139
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:49 GMT
expires: Tue, 15 Oct 2024 14:11:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10104846.fls.doubleclick.net/activityi;dc_pre=CPCbscbIkIkDFamqjggdyt0dHQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3435340169617.6313?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 227 KB
58 KB 283ms
144ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

Resource Hash

91aff3588efba0074124bbd204b45de0da882a853f29a1d73f7ec132291c5651

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=131, rtx=0, c=24, mss=1232, tbw=8216, tp=13, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: ddcw4h0DKtWNO92TettF1kV5Yxcy3F5inBpTnm9LtUk3+dFyeGhoh4XL6KAhU+ZSBZxdsMncgYZ62R6HGRhEpg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 59352
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 siteanalyze_6033413.js Show response
siteimproveanalytics.com/js/ 38 KB
12 KB 201ms
90ms Script
application/javascript 172.67.163.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6033413.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.163.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "8451e15415563cef4e816d6dd250d58a"
age: 6408
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QyNCkHXvHXDL2aPFRFdfMbOQ6%2FBR%2Fh%2FZiMVYuPffpkmgAcKC8VI8exMT6ZCvpy1IMCifIbdRJrYSuXCylmR2sKVaw15Qhl7FsyD7UNJTpbnEWH3CQag2vrCEX%2BL0vn6mgp2c1ztewuplfi4%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 03 Sep 2024 18:55:37 GMT
vary: Accept-Encoding
x-amz-id-2: tm/yqzPFoRfysXtavuApin/Knv5fU5ltsp2ilYLYyXLRTDjqKJCACvntN4UVSaHsSicRAkAGOHASidh55zfdSw==
cache-control: max-age=86400, no-transform
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: E35D9YX9R12XRX50
cf-ray: 8d30668baefd5257-LAX
accept-ranges: bytes
content-length: 11550
server: cloudflare

GET
H2 200 adsct
t.co/i/ 43 B
161 B 147ms
146ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=8a7d8b91-6182-4578-9148-17a3e9e6f67a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7e59861b-3dbc-4189-a49d-35f95299b191&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 9594628e05baf0c1
cache-control: no-cache, no-store, max-age=0
x-connection-hash: a23810bf2cbc80a3248ad1a723e31a971090568d06673771aef2fefe4cdb9c8e
cf-cache-status: DYNAMIC
cf-ray: 8d30668affc1319d-LAX
x-response-time: 6
content-length: 43
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_p

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
234 B 111ms
110ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=8a7d8b91-6182-4578-9148-17a3e9e6f67a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7e59861b-3dbc-4189-a49d-35f95299b191&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 4b17f2591068ec4d
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 2a818bb6139cdeaa535ca6e25c9179cb3b820072e4bde1ca419aa775b04a65c2
x-response-time: 5
content-length: 43
date: Tue, 15 Oct 2024 14:11:49 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_p

GET
H/1.1 200
OK is Show response
44.212.189.233/ 32 B
437 B 542ms
132ms Fetch
text/plain 44.212.189.233
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://44.212.189.233/is?cb=1729001509269
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=95504005523385470term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 44.212.189.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-189-233.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: 835a378479e2f62ad60739025cac3f2a8b47ad3aeed886d877fcaad17ee4e463

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 2
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
content-length: 32
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/plain;charset=utf-8
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET

usersync
tracking.contanuity.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1729001508702
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=0ac9c017dfdd772893a32ead8dfce3c5_1729001508702&_bee_ppp=1
https://tracking.contanuity.com/usersync?bwcookie=AAFNRk7OHPAAABOsi8_mkQ

0
0

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
333 B 146ms
145ms XHR
text/plain 34.196.140.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=NZlTqtu9vowXrexrDZrWUA&is_js=true&landing_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&t=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&tip=GuroVJN0AQF3x2Me1Pxs4vNmRYAtgyT77-Way6RYbhk&host=https%3A%2F%2Fwww.fortinet.com&sa_conv_data_css_value=%270-1dd84340-a531-5dcb-747b-2ecda36f7582%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd91dd84340a5315dcb747b2ecda36f7582a2f5cef4&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKINGcs0buF5CUQNN4YmnkIk9TX4HbLs5a9t3dtOVGqLwmENYBGAQgpfC5uAYwAToEQN4Ii0IEe2ssMA.tJxU9UUG4EKGQ9q%252F%252BgE09hQ32PXJYZixnCmL%252FXPX2Tc&sa-user-id-v2=s%253AHdhDQKUxXct0ey7No291gqL1zvQ.MlSPk5v4MUDwGgUiktoyvpGG0YaMjUPMN%252BkYvU00tEs&sa-user-id=s%253A0-1dd84340-a531-5dcb-747b-2ecda36f7582.fuHu9M0%252Br4TjuQnvOw1gr0O4MU1Ifg9Nborqwd%252F2Sgg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.140.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-140-205.compute-1.amazonaws.com
Software: /
Resource Hash: e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
content-length: 138
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 tag.aspx Show response
ml314.com/ 38 KB
13 KB 220ms
69ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?159
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
content-encoding: br
age: 1692
x-goog-stored-content-encoding: identity
x-cache-hit: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39162
date: Tue, 15 Oct 2024 13:43:38 GMT
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
content-type: application/javascript
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY1X5o-GkrRPArC9wxXM27gvYcBld41bbLuC2NwnjN4LY4Xdu4RJ5-BixxACa8ogCrj28kg
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
cache-id: LAX
accept-ranges: bytes
x-goog-generation: 1721849450340665
content-length: 12522
server: UploadServer

GET
H2 200 image.aspx
6033413.global.siteimproveanalytics.io/ 34 B
149 B 436ms
121ms Image
image/gif 3.94.188.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6033413.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&res=1600x1200&accountid=6033413&rt=6159&prev=3c35494c-3dc7-4fd7-8910-9a345090e626&luid=df46dc28-e802-8c0e-c01d-507449732e2a&rnd=46574
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.94.188.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-94-188-245.compute-1.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: Tue, 15 Oct 2024 14:11:50 UTC
cache-control: max-age=0
content-length: 34
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: image/gif

GET
H2 401 / Show response
webtracker.argusplatform.com/wh/track/ 205 B
468 B 887ms
610ms XHR
application/json 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1729001509210137504&event_type=page_request&timestamp=1729001510&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20241015T141150Z-17b8d69fbb5nbmgd1afgggcuvs00000006v000000000k68b

GET
H3 200 177020962864941 Show response
connect.facebook.net/signals/config/ 66 KB
13 KB 238ms
234ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.171&r=stable&domain=www.fortinet.com&hme=d82868061a8c707cd31395a3055e7449daa03bd520872727258c39e6af34523e&ex_m=70%2C120%2C106%2C110%2C61%2C4%2C99%2C69%2C16%2C96%2C88%2C51%2C54%2C171%2C174%2C186%2C182%2C183%2C185%2C29%2C100%2C53%2C77%2C184%2C166%2C169%2C179%2C180%2C187%2C130%2C41%2C34%2C142%2C15%2C50%2C193%2C192%2C132%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C92%2C17%2C14%2C95%2C91%2C90%2C107%2C52%2C109%2C39%2C108%2C30%2C93%2C26%2C167%2C170%2C139%2C85%2C56%2C83%2C33%2C73%2C0%2C94%2C32%2C28%2C82%2C87%2C47%2C46%2C86%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C101%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C103%2C102%2C104%2C97%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C89%2C81%2C44%2C35%2C84%2C2%2C36%2C63%2C42%2C105%2C45%2C79%2C68%2C111%2C60%2C59%2C31%2C98%2C58%2C55%2C49%2C78%2C72%2C24%2C112

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

Resource Hash

e0ddca762f4308a8f15b047f5388caebbdc43d87913df1b174b9e279cb1c275e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=132, rtx=0, c=77, mss=1232, tbw=71340, tp=69, tpl=0, uplat=89, ullat=0
pragma: public
x-fb-debug: iHExuNZT1i5s/xJgm+VW3bh4x8dAyOajW8pcGlAmxrR7xhhT5rSJY8dDu5WtuTc3V4YVVjKSL/Z9dnmxbrUrEg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 143ms
142ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A49%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223024%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&ipv6=2a04%3Ac604%3A615%3A1%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:50 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 utsync.ashx Show response
ml314.com/ 641 B
1 KB 115ms
110ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pv=1729001510083_tixc4f45w&bl=en-us&cb=3596206&return=&ht=&d=&dc=&si=1729001510083_tixc4f45w&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?159
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 6d4e2946e903d1003a0f566f287eede9a060c90212d8043a912e2a8d5ff86a64

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: application/javascript
server: Google Frontend

GET
H2 200 ibs:dpid=22052&dpuuid=3647725149520134151&redir=
dpm.demdex.net/ 42 B
714 B 141ms
132ms Image
image/gif 18.209.0.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3647725149520134151&redir=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.209.0.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-209-0-122.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v065-0579468a0.edge-va6.demdex.com 6 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: dZVWCNieTKg=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: image/gif

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3647725149520134151
https://ml314.com/csync.ashx?fp=36da98ba0d466c05d2223be8d247edb4bdce22b483ea1178c067cd963f318f9ff4cb09cee1a4f8eb&person_id=3647725149520134151&eid=50082

43 B
56 B

128ms
128ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=36da98ba0d466c05d2223be8d247edb4bdce22b483ea1178c067cd963f318f9ff4cb09cee1a4f8eb&person_id=3647725149520134151&eid=50082
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Wed, 16 Oct 2024 14:11:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://ml314.com/csync.ashx?fp=36da98ba0d466c05d2223be8d247edb4bdce22b483ea1178c067cd963f318f9ff4cb09cee1a4f8eb&person_id=3647725149520134151&eid=50082
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Tue, 15 Oct 2024 14:11:50 GMT

GET
H3

200

utsync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&gdpr=0&gdpr_consent=

43 B
61 B

136ms
134ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0,Wed, 16 Oct 2024 14:11:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

location: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&gdpr=0&gdpr_consent=
content-length: 241
date: Tue, 15 Oct 2024 14:11:50 GMT
server: Kestrel

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3647725149520134151%26eid=2
https://ml314.com/csync.ashx?fp=468448509069140886&person_id=3647725149520134151&eid=2

43 B
56 B

124ms
124ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=468448509069140886&person_id=3647725149520134151&eid=2
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Wed, 16 Oct 2024 14:11:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-store, no-cache, private
location: https://ml314.com/csync.ashx?fp=468448509069140886&person_id=3647725149520134151&eid=2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: a8e790f2-c2f8-4c6a-9db0-bda6a2d2b3d7
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:50 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2X7L1Zw3GpVD2rayQ0aPuro3bI5ZZ02lMJiSQ1i91FOU&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
https://ml314.com/csync.ashx?fp=2X7L1Zw3GpVD2rayQ0aPuro3bI5ZZ02lMJiSQ1i91FOU&person_id=3647725149520134151&eid=50052&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referre...
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

70 B
440 B

130ms
130ms

Image
image/gif

52.3.138.212
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Protocol: HTTP/1.1
Server: 52.3.138.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-138-212.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 15 Oct 2024 14:11:51 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
via: 1.1 google
expires: Wed, 16 Oct 2024 14:11:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Tue, 15 Oct 2024 14:11:51 GMT
content-type: image/gif
x-cloud-trace-context: edd298660ab1367a6bfd8db674d6244f
server: Google Frontend

GET
H2 200 /
www.facebook.com/tr/ 0
270 B 419ms
138ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&rl=&if=false&ts=1729001510225&sw=1600&sh=1200&v=2.9.171&r=stable&ec=0&o=12318&fbp=fb.1.1729001510219.111183966206556596&ler=empty&cdl=API_unavailable&it=1729001509942&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=130, rtx=0, c=10, mss=1297, tbw=2962, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 602ms
321ms Image
image/png 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&rl=&if=false&ts=1729001510225&sw=1600&sh=1200&v=2.9.171&r=stable&ec=0&o=12318&fbp=fb.1.1729001510219.111183966206556596&ler=empty&cdl=API_unavailable&it=1729001509942&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7426004940975132452"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xf77e856888256f1c","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"3":["1473595392721544"]},"debug_reporting":true,"debug_key":"4290568162945147571"}
date: Tue, 15 Oct 2024 14:11:50 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: 3lsTgS57FDyzObepkVRqQWKq7KOnOgo4rBM1ZE51PbqsMSDcE0gb7I1B86c3r/VX/3hnTECVBLk38cJBb1GyHg==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7426004940975132452", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=131, rtx=0, c=14, mss=1297, tbw=3276, tp=-1, tpl=-1, uplat=180, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
251 B 147ms
145ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: FB6FF5F284D5406997E666DFCD24CFB7 Ref B: LAX311000112031 Ref C: 2024-10-15T14:11:50Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYkhIjdtZOMKP6xy/CsLw==
x-li-proto: http/2
access-control-allow-origin: https://www.fortinet.com
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:50 GMT
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 144ms
142ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A51%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A50%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%224028%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&ipv6=2a04%3Ac604%3A615%3A1%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:51 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:51 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 3 KB
2 KB 559ms
99ms Script
application/javascript 44.235.191.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=246457897.1729001507&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001507%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001508%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22246457897.1729001507%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729001507.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%227CK4D8vRu2zRza9%2BfXJvn9LV8d50Viud%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729001507.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001507%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001508%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=95504005523385470term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=95504005523385470term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 44.235.191.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-235-191-156.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 6dc30577115228c8762ec07bf5b4c9930d9a283de985f0d78b86f9ae3eda32fd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 0
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Tue, 15 Oct 2024 14:11:51 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H/1.1 200
OK gs Show response
gs.mountain.com/ 144 B
733 B 402ms
100ms Script
application/javascript 35.81.162.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gs.mountain.com/gs
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=246457897.1729001507&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001507%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001508%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22246457897.1729001507%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729001507.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%227CK4D8vRu2zRza9%2BfXJvn9LV8d50Viud%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729001507.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001507%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001508%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=95504005523385470term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.81.162.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-81-162-201.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 3c476709657631c6042c47b958d5d7f9bb098dfc56478420f47d9eae5df9c62c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 0
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Tue, 15 Oct 2024 14:11:52 GMT
content-length: 144
content-type: application/javascript;charset=utf-8
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 142ms
134ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A51%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225029%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&ipv6=2a04%3Ac604%3A615%3A1%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:52 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:52 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 6 KB
2 KB 312ms
118ms Script
application/javascript 44.235.191.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=246457897.1729001507&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001507%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001508%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22246457897.1729001507%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729001507.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%227CK4D8vRu2zRza9%2BfXJvn9LV8d50Viud%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729001507.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001507%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001508%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue&cb=1729001511797829&shguid=ee933184-ca11-307a-a3f5-c910c3017530&shgts=1729001512202
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=246457897.1729001507&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001507%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001508%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%22246457897.1729001507%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729001507.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%227CK4D8vRu2zRza9%2BfXJvn9LV8d50Viud%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729001507.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001507%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001508%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=95504005523385470term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 44.235.191.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-235-191-156.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: bc639cf58861c784d58cc39a9122f666fe15163dcd4c96004486d68f7c3c397f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 19
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Tue, 15 Oct 2024 14:11:52 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H/1.1

200
OK

tdsync
px.steelhousemedia.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=6cc5cb1b-8aff-11ef-b004-333b298a5d6e&gdpr=&gdpr_consent=
https://px.steelhousemedia.com/tdsync?tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&shguid=6cc5cb1b-8aff-11ef-b004-333b298a5d6e

0
320 B

692ms
392ms

Image
text/plain

44.225.29.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.steelhousemedia.com/tdsync?tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&shguid=6cc5cb1b-8aff-11ef-b004-333b298a5d6e
Protocol: HTTP/1.1
Server: 44.225.29.129 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-225-29-129.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 294
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Tue, 15 Oct 2024 14:11:53 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

Redirect headers

location: https://px.steelhousemedia.com/tdsync?tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&shguid=6cc5cb1b-8aff-11ef-b004-333b298a5d6e
content-length: 277
date: Tue, 15 Oct 2024 14:11:52 GMT
server: Kestrel

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3
https://dpm.demdex.net/ibs:dpid=903&dpuuid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=468448509069140886&ttd_tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ODI1ZWE0ODYtYjIxYS00ZGEzLTk3ZmYtZTFhMjZiMGNhMGVl&gdpr=0&gdpr_consent=&ttd_tdid=825ea486-b21a-4da3-97ff-e1a26...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&google_error=15
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=825ea486-b21a-4da3-97ff-e1a26b0ca0ee&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D1330d32d-bed1-42d1-9521-417993b920ac%252Chttps%2525...
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=468448509069140886&pt=1330d32d-bed1-42d1-9521-417993b920ac%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%2...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad

70 B
497 B

94ms
93ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
Protocol: H2
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-length: 70
date: Tue, 15 Oct 2024 14:11:54 GMT
content-type: image/gif
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Tue, 15 Oct 2024 14:11:54 GMT
server: Jetty(11.0.13)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 189ms
188ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A52%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226030%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&ipv6=2a04%3Ac604%3A615%3A1%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:53 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:53 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 141ms
140ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A53%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227031%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&ipv6=2a04%3Ac604%3A615%3A1%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:54 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:54 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 142ms
142ms Image
image/gif 23.34.59.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=bb329e89-bf15-4f98-802b-1a7a7391fbce&session=e72ce87c-72f7-4c96-85d7-09bd0372aac0&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A54%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%228031%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=7026d7c9-264e-4dc1-8245-4e290d67ffd9&ipv6=2a04%3Ac604%3A615%3A1%3A%3A5&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-26.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:55 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:55 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ad.doubleclick.net
URL: https://ad.doubleclick.net/activity;register_conversion=1;src=10050195;npa=0;auiddc=1369907835.1729001507;ps=1;pcor=1279793537;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Domain: s.ad.smaato.net
URL: https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=613CCCB341A147B5857B261E2C187A9E

Domain: loadm.exelator.com
URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=613CCCB341A147B5857B261E2C187A9E&j=0

Domain: tracking.contanuity.com
URL: https://tracking.contanuity.com/usersync?bwcookie=AAFNRk7OHPAAABOsi8_mkQ

Verdicts & Comments Add Verdict or Comment

166 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

122 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-21 09:02:21	Name: cookiesession1 Value: 678A3E5A201896E05C4448549F99EEAA
.fortinet.com/	1970-01-21 09:02:17	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Tue+Oct+15+2024+04%3A11%3A45+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=6.10.0&hosts=&consentId=1de31795-deda-4043-8db6-8104244a4e17&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.fortinet.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-21 04:35:53	Name: demdex Value: 80879264112703762071257771742052073124
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
.fortinet.com/	1970-01-21 00:16:43	Name: mboxEdgeCluster Value: 34
.fortinet.com/	1970-01-21 09:52:41	Name: mbox Value: session#e15c6229587b4d008b25e083709ee32b#1729003367\|PC#e15c6229587b4d008b25e083709ee32b.34_0#1792246307
.dpm.demdex.net/	1970-01-21 04:35:53	Name: dpm Value: 80879264112703762071257771742052073124
.fortinet.com/	1970-01-21 09:52:41	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 179643557%7CMCIDTS%7C20012%7CMCMID%7C81222992427100023111293274871721860908%7CMCAAMLH-1729606305%7C7%7CMCAAMB-1729606305%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1729008705s%7CNONE%7CMCSYNCSOP%7C411-20019%7CvVersion%7C5.5.0
.simpli.fi/	1970-01-21 09:03:43	Name: suid Value: 613CCCB341A147B5857B261E2C187A9E
.fortinet.com/	1970-01-21 00:18:07	Name: _uetsid Value: 69d9d2008aff11efbd78e5630e43c411
.fortinet.com/	1970-01-21 09:38:17	Name: _uetvid Value: 69d9faa08aff11ef9d00f7c695d64b16
www.fortinet.com/	1970-01-21 09:52:41	Name: _gd_visitor Value: bb329e89-bf15-4f98-802b-1a7a7391fbce
.bing.com/	1970-01-21 09:38:17	Name: MUID Value: 07D42DC2CF136F9F0A8438DBCEFD6EAA
.bat.bing.com/	1970-01-21 00:26:46	Name: MR Value: 0
www.fortinet.com/	1970-01-21 00:16:55	Name: _gd_session Value: e72ce87c-72f7-4c96-85d7-09bd0372aac0
.fortinet.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.fortinet.com/	1970-01-21 02:26:17	Name: _gcl_au Value: 1.1.1369907835.1729001507
www.fortinet.com/	1970-01-21 00:16:41	Name: dicbo_id Value: %7B%22dicbo_fetch%22%3A1729001507359%7D
.fortinet.com/	1970-01-21 09:52:41	Name: _ga_38BQ9XFDT4 Value: GS1.1.1729001507.1.0.1729001507.0.0.0
.fortinet.com/	1970-01-21 09:52:41	Name: _ga Value: GA1.1.246457897.1729001507
.fortinet.com/	1970-01-21 00:18:07	Name: _ce.clock_data Value: 185%2C162.245.206.244%2C1%2Ccd70ceeb4a1768030b1882c90242a428%2CChrome%2CUS
.fortinet.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.fortinet.com/	1970-01-21 09:02:17	Name: _ce.s Value: v~297fe7d4c3f02cbf5d07af27447762e0570a5a77~lcw~1729001507900~vir~new~lva~1729001507211~vpv~0~v11.cs~424000~v11.s~6a7300b0-8aff-11ef-87f7-0dbec0b62732~lcw~1729001507901
.fortinet.com/	1970-01-21 00:16:43	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
.fortinet.com/	1970-01-21 02:26:17	Name: s_getNewRepeat Value: 1729001507906-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
www.fortinet.com/	1970-01-21 09:52:41	Name: _omappvp Value: VcBOOX1VRspjcG8K6a86sCnuoUeLsOBBg1kh1GnGF1x1DjwQ7LR0IS4cN5YyQolq6kTYcTPeFGQbEazNLmc8MNKkQFaGGCmR
www.fortinet.com/	1970-01-21 00:16:42	Name: _omappvs Value: 1729001508011
.doubleclick.net/	1970-01-21 04:35:53	Name: receive-cookie-deprecation Value: 1
.techtarget.com/	1970-01-21 00:16:43	Name: __cf_bm Value: wu4xPqj4joBaaVypOJ7d.AgVqmA4M_q39cXnEacHJlw-1729001508-1.0.1.1-PoihkHb2XZJDGpjv6yOL00F4ytke1iYgpCmod55pSszOd.7Mg6hvPAlXRTOx9rUgAxNpNaZViKIhwEWfQNTZfw
.fortinet.com/	1970-01-21 09:52:41	Name: _ga_JH142QCQCJ Value: GS1.1.1729001508.1.0.1729001508.0.0.0
.www.fortinet.com/	1970-01-21 09:02:17	Name: WID_VISITOR_ID Value: 1729001509210137504
www.fortinet.com/	1970-01-21 00:26:46	Name: AWSALB Value: 1snBeAPF8jMJLGBHHhHTxzcPl0iTj2PQcvV36a7wAkCxhIdFrZZTahsFgsyWZ2MVJvJP+5mI0BF4Hikh1VertyQr0DXhbT08ClrD5fnfxTozH6PBUWDX7Hhupl58XYYuHwMZGw0vHZM+KBrXH+3Yz8cln+GQg1QG8l6JJaPg112SSq5z4YVyTU5w0LhOcxoLH6jxR26mr+66I59Yr254b/4QBm7oEWKQ
www.fortinet.com/	1970-01-21 00:26:46	Name: AWSALBCORS Value: BfFxI3LAUNH9xLYnK31CHRBuryLRGyHzjjaCOtH7wj5W2DQtk3f8/J5P+XbTE3JTdIEJDTliANNnypGOAtHnNYitU6RgwfGvTk/lv6q6UNOJYcxUXe874eanyRVJ/5U7QDXg8mvatrAWH/TpSeC3+x8OKLFBNV1ejhFexuBUBhpmj7EW0YdLQV736vjXGZOj3N+mLJNQT9I8B6T56udxk1hMvTSxRbGL
.simpli.fi/	1970-01-21 00:26:46	Name: uid_syncd_secure Value: true
abm-tracking.demandscience.com/	1970-01-21 09:52:41	Name: userId Value: 0ac9c017dfdd772893a32ead8dfce3c5_1729001508702
tags.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id Value: s%3A0-1dd84340-a531-5dcb-747b-2ecda36f7582.fuHu9M0%2Br4TjuQnvOw1gr0O4MU1Ifg9Nborqwd%2F2Sgg
.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id Value: s%3A0-1dd84340-a531-5dcb-747b-2ecda36f7582.fuHu9M0%2Br4TjuQnvOw1gr0O4MU1Ifg9Nborqwd%2F2Sgg
tags.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id-v2 Value: s%3AHdhDQKUxXct0ey7No291gqL1zvQ.MlSPk5v4MUDwGgUiktoyvpGG0YaMjUPMN%2BkYvU00tEs
.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id-v2 Value: s%3AHdhDQKUxXct0ey7No291gqL1zvQ.MlSPk5v4MUDwGgUiktoyvpGG0YaMjUPMN%2BkYvU00tEs
tags.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id-v3 Value: s%3AAQAKINGcs0buF5CUQNN4YmnkIk9TX4HbLs5a9t3dtOVGqLwmENYBGAQgpfC5uAYwAToEQN4Ii0IEe2ssMA.tJxU9UUG4EKGQ9q%2F%2BgE09hQ32PXJYZixnCmL%2FXPX2Tc
.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id-v3 Value: s%3AAQAKINGcs0buF5CUQNN4YmnkIk9TX4HbLs5a9t3dtOVGqLwmENYBGAQgpfC5uAYwAToEQN4Ii0IEe2ssMA.tJxU9UUG4EKGQ9q%2F%2BgE09hQ32PXJYZixnCmL%2FXPX2Tc
www.fortinet.com/	1970-01-21 09:02:17	Name: sa-user-id Value: s%253A0-1dd84340-a531-5dcb-747b-2ecda36f7582.fuHu9M0%252Br4TjuQnvOw1gr0O4MU1Ifg9Nborqwd%252F2Sgg
www.fortinet.com/	1970-01-21 09:02:17	Name: sa-user-id-v2 Value: s%253AHdhDQKUxXct0ey7No291gqL1zvQ.MlSPk5v4MUDwGgUiktoyvpGG0YaMjUPMN%252BkYvU00tEs
www.fortinet.com/	1970-01-21 09:02:17	Name: sa-user-id-v3 Value: s%253AAQAKINGcs0buF5CUQNN4YmnkIk9TX4HbLs5a9t3dtOVGqLwmENYBGAQgpfC5uAYwAToEQN4Ii0IEe2ssMA.tJxU9UUG4EKGQ9q%252F%252BgE09hQ32PXJYZixnCmL%252FXPX2Tc
.adnxs.com/	1970-01-21 09:52:41	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 02:26:17	Name: XANDR_PANID Value: 1dgVKckTDpAzlO6nozjBm4JOF3COuWVb-fs2SvKwJ2n2Vh1wDZvYHY4_b1PgYxGo8SZOgxrmDpiQXSB9FoIkcUKCXNp1vHRrRrBKmR5_2dw.
.adnxs.com/	1970-01-21 02:26:17	Name: uuid2 Value: 468448509069140886
.adnxs.com/	1970-01-21 02:26:17	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2E?gd@5Ap!]tbPl1N!7On*M$=BWo!ka.x5fp7T^iItmjfoj5[lw`]bi.07oi+.WhiX)bBPVlR_/X%W#.wL4W1Qw2SXg_([
tracking.contanuity.com/	1970-01-21 09:52:41	Name: userId Value: 0ac9c017dfdd772893a32ead8dfce3c5_1729001508702
tracking.contanuity.com/	1970-01-21 09:52:41	Name: clientId Value: undefined
.3lift.com/	1970-01-21 02:26:17	Name: tluidp Value: 261325290369862806867
.3lift.com/	1970-01-21 02:26:17	Name: tluid Value: 261325290369862806867
.openx.net/	1970-01-21 09:02:17	Name: i Value: cee1349f-49e9-49e3-a5cf-b8cc205fcab4\|1729001509
.tapad.com/	1970-01-21 01:43:05	Name: TapAd_TS Value: 1729001509503
.tapad.com/	1970-01-21 01:43:05	Name: TapAd_DID Value: 1330d32d-bed1-42d1-9521-417993b920ac
.t.co/	1970-01-21 09:52:41	Name: muc_ads Value: 0f40d7b5-004c-440c-88f6-2c5e866e7b35
.t.co/	1970-01-21 00:16:43	Name: __cf_bm Value: Sle7837E6s.A.YGx2vtpzValcYAJuhLJd4wVUbB2mw0-1729001509-1.0.1.1-08gmC8GEkk3DXAXMeQWbhacv5IfY6gNsY7t1DT2FwquUsx5BweQ8.4s1UwCPWQnMYDawfBVv_9JNlOsgaCedTg
.doubleclick.net/	1970-01-21 09:52:41	Name: IDE Value: AHWqTUlXgEv2RpX-SfKdbYQtutOw3rp7cvYIElgkXQhTqL3w9Y7AGm8OHSKDCrFM
.linkedin.com/	1970-01-21 02:26:17	Name: li_sugr Value: 3d902fc5-f502-444f-928b-a5cfbe85e8a5
.linkedin.com/	1970-01-21 09:02:17	Name: bcookie Value: "v=2&9cdc6a06-9d81-4342-879b-9614f5d96bf5"
.linkedin.com/	1970-01-21 00:18:07	Name: lidc Value: "b=VGST06:s=V:r=V:a=V:p=V:g=3110:u=1:x=1:i=1729001509:t=1729087909:v=2:sig=AQHZTckT6KQWEV4xqbuvquSwPQZyMmX4"
.twitter.com/	1970-01-21 09:52:41	Name: personalization_id Value: "v1_Cz7H1S9g2rbnzLVVmC/RqA=="
.pro-market.net/	1970-01-21 04:35:53	Name: anProfile Value: "-1jjcinh7o0fbn+1+1f=1+1g=1+1j=57:1+rs=s+rt=2A04C604061500010000000000000005+s2=(slei3p)+vm=24-613CCCB341A147B5857B261E2C187A9E"
.pro-market.net/	1970-01-21 00:59:53	Name: anHistory Value: "-1jjcinh7o0fbn+2+!#6wM%8!X_r"
.pubmatic.com/	1970-01-21 00:59:53	Name: KRTBCOOKIE_148 Value: 19421-uid:613CCCB341A147B5857B261E2C187A9E&KRTB&23486-uid:613CCCB341A147B5857B261E2C187A9E&KRTB&23489-uid:613CCCB341A147B5857B261E2C187A9E&KRTB&23539-uid:613CCCB341A147B5857B261E2C187A9E
.pubmatic.com/	1970-01-21 00:59:53	Name: PugT Value: 1729001509
.intentiq.com/	1970-01-21 09:52:41	Name: IQver Value: 1.9
.intentiq.com/	1970-01-21 09:52:41	Name: intentIQ Value: yHGn5YxzMg
.lijit.com/	1970-01-21 09:02:17	Name: ljt_reader Value: JgDzAQZHg9NjNDCnSPmjr1n3
.yahoo.com/	1970-01-21 09:02:39	Name: A3 Value: d=AQABBCV4DmcCEHWCTRkW-jIT3snxdjum-rcFEgEBAQHJD2cYZ9wAAAAA_eMAAA&S=AQAAAo9mpVElrjPoY6xgzvXhNXM
.agkn.com/	1970-01-21 09:02:17	Name: ab Value: 0001%3AAdX6d0zsA9f1qSD%2BmHPxbj69EfoGhI1%2F
www.fortinet.com/	1970-01-21 00:18:09	Name: aa_cc Value: US
www.fortinet.com/	1970-01-21 00:18:09	Name: aa_cn Value: United%20States
www.fortinet.com/	1970-01-21 00:18:09	Name: 6scexist Value: true
.bfmio.com/	1970-01-21 09:02:17	Name: __141_cid Value: 613CCCB341A147B5857B261E2C187A9E
.bfmio.com/	1970-01-21 09:02:17	Name: __io_cid Value: 8022baa015c87a12c44978f71906a3f13d2e7fbe
.linkedin.com/	1970-01-21 00:59:53	Name: UserMatchHistory Value: AQKRJ34Q4W1PgAAAAZKQhVOLrSE4MzziPU8IExm969zE54CBmIU3a5uu8lkbpheAC3OCGOSgBH76iA
.linkedin.com/	1970-01-21 00:59:53	Name: AnalyticsSyncHistory Value: AQJqd00gHPYBrQAAAZKQhVOLJSbApf0bcqc3NSVJLJZgK6pEdJDr_MyMMpW0QO-ylp8F5MOC9e-JmdAK01rMng
.fortinet.com/	1970-01-21 09:52:41	Name: nmstat Value: 3c35494c-3dc7-4fd7-8910-9a345090e626
.rubiconproject.com/	1970-01-21 09:02:17	Name: khaos Value: M2AIUV8T-4-14MI
.rubiconproject.com/	1970-01-21 09:02:17	Name: khaos_p Value: M2AIUV8T-4-14MI
.rubiconproject.com/	1970-01-21 02:26:17	Name: receive-cookie-deprecation Value: 1
.crwdcntrl.net/	1970-01-21 06:45:29	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 06:45:29	Name: _cc_id Value: 290e39875e8da6f0bc5f84d31f072151
.analytics.yahoo.com/	1970-01-21 09:02:17	Name: IDSYNC Value: 176k~2l9q
.ads.stickyadstv.com/	1970-01-21 00:59:53	Name: UID Value: f471737a5657614aee44fc33a4c6f32
.ads.stickyadstv.com/	1970-01-21 00:18:07	Name: uid-bp-26865 Value: 613CCCB341A147B5857B261E2C187A9E
.lijit.com/	1970-01-21 09:02:17	Name: _ljtrtb_2 Value: 613CCCB341A147B5857B261E2C187A9E
.intentiq.com/	1970-01-21 09:52:41	Name: CSDT Value: UEQ6MTAwNDNfMCZVUkhXOEZS
.intentiq.com/	1970-01-21 09:52:41	Name: intentIQCDate Value: 1729001509883
.intentiq.com/	1970-01-21 09:52:41	Name: ASDT Value: 0
.intentiq.com/	1970-01-21 09:52:41	Name: IQPData Value: 2734018292#1729001509877#0#1729001509877
.pippio.com/	1970-01-21 09:02:17	Name: did Value: j4PAj7CEGCQzsulB
.pippio.com/	1970-01-21 09:02:17	Name: didts Value: 1729001509
.pippio.com/	1970-01-21 01:43:05	Name: nnls Value:
.pippio.com/	1970-01-21 01:43:05	Name: pxrc Value: CKXwubgGEgYIgr0rEAA=
.www.linkedin.com/	1970-01-21 09:02:17	Name: bscookie Value: "v=1&202410151411492bcce96b-7870-4fcf-8c34-526af48d32e8AQE_UYwqU7ICCYLrWT7734gkC0HZOxSw"
.smartadserver.com/	1970-01-21 09:02:17	Name: TestIfCookieP Value: ok
.smartadserver.com/	1970-01-21 09:02:17	Name: pbw Value: %24b%3d16999%3b%24o%3d99999
.ml314.com/	1970-01-21 09:02:17	Name: pi Value: 3647725149520134151
.ml314.com/	1970-01-21 00:36:51	Name: tp Value: 4%253B10%252F15%252F2024%2B14%253A11%253A50
.agkn.com/	1970-01-21 09:02:17	Name: u Value: C\|0AAAAAAAALqE0pgAAAAAA
.fortinet.com/	1970-01-21 02:26:17	Name: _fbp Value: fb.1.1729001510219.111183966206556596
.bidr.io/	1970-01-21 09:45:15	Name: bito Value: AAFNRk7OHPAAABOsi8_mkQ
.bidr.io/	1970-01-21 09:45:15	Name: bitoIsSecure Value: ok
.smartadserver.com/	1970-01-21 09:02:17	Name: pid Value: 7728817134678143967
.rlcdn.com/	1970-01-21 09:02:17	Name: rlas3 Value: uQq2GCNr5ADFwN3smMuhqs2Ka9MucUSQPr+OaFZ4u2I=
.rlcdn.com/	1970-01-21 01:43:05	Name: pxrc Value: CKXwubgGEgUI6AcQABIFCOhHEAASBQjbThAB
.doubleclick.net/	1970-01-21 00:59:53	Name: ar_debug Value: 1
.adsrvr.org/	1970-01-21 09:02:17	Name: TDID Value: 825ea486-b21a-4da3-97ff-e1a26b0ca0ee
.ml314.com/	1970-01-21 00:16:41	Name: u Value: aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLw%3D%3D
.eyeota.net/	1970-01-21 09:02:17	Name: mako_uid Value: 1929085570d-6b610000010a517d
.eyeota.net/	1970-01-21 00:16:42	Name: SERVERID Value: 20861~DM
.mountain.com/	1970-01-21 09:02:17	Name: guid Value: 6cc5cb1b-8aff-11ef-b004-333b298a5d6e
.px.mountain.com/	1970-01-21 09:02:17	Name: tt Value: "H4sIAAAAAAAAAKtW8guKNzYyNjaLNzK3NFayMtBRgnItjC2UrAzNjSwNDAxNDY1MDYBSZUpWRjpIWsBqDGoBxweihEYAAAA="
.mountain.com/	1970-01-21 09:02:17	Name: rt Value: "MzIzMzY6MTcyOTAwMTUxMg=="
.rubiconproject.com/	1970-01-21 09:02:17	Name: audit_p Value: 1\|rBfS6cdpeUEh8ZTQghOF5Bw164qOAx2YC2Ry+IwrCrWCZIg+tqclAS5Wur3OsoG4w3KyGVwgDV+M1KxoLazIt04KBbjzRD/Y5dDZuxGLGk9imtv5XZy2AM05GG7suNY43Mpo9z6fJ14XpLeFeTaCZWKuW1PvdMXdSpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.rubiconproject.com/	1970-01-21 09:02:17	Name: audit Value: 1\|rBfS6cdpeUEh8ZTQghOF5Bw164qOAx2YC2Ry+IwrCrWCZIg+tqclAS5Wur3OsoG4w3KyGVwgDV+M1KxoLazIt04KBbjzRD/Y5dDZuxGLGk9imtv5XZy2AM05GG7suNY43Mpo9z6fJ14XpLeFeTaCZWKuW1PvdMXdSpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.tapad.com/	1970-01-21 01:43:05	Name: TapAd_3WAY_SYNCS Value: 2!6950
.adsrvr.org/	1970-01-21 09:02:17	Name: TDCPM Value: CAESFgoHZDB0cm8xahILCJq2toiry7Y9EAUSEgoDYWFtEgsInOLBvPGYqz0QBRIXCghhcHBuZXh1cxILCILy0KCry7Y9EAUSFgoHcnViaWNvbhILCMqS0aCry7Y9EAUSFQoGZ29vZ2xlEgsI0qndvsudtD0QBRIUCgV0YXBhZBILCKT-5airy7Y9EAUYBTgBQgQiAggB

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1729001509210137504&event_type=page_request&timestamp=1729001509&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://stags.bluekai.com/site/29931?id=613CCCB341A147B5857B261E2C187A9E Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network	error	URL: https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1729001509210137504&event_type=page_request&timestamp=1729001510&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
6033413.global.siteimproveanalytics.io
a.omappapi.com
a.opmnstr.com
aa.agkn.com
abm-tracking.demandscience.com
ad.doubleclick.net
ads.stickyadstv.com
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
b.6sc.co
bat.bing.com
bcp.crwdcntrl.net
c.6sc.co
cdn.cookielaw.org
cdn.jsdelivr.net
ce.lijit.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
d.agkn.com
dpm.demdex.net
dx.mountain.com
eb2.3lift.com
eps.6sc.co
fei.pro-market.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
i.simpli.fi
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
image2.pubmatic.com
insight.adsrvr.org
intentstream.contanuity.com
ipv6.6sc.co
j.6sc.co
loadm.exelator.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
pippio.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
pixels.argusplatform.com
ps.eyeota.net
px.ads.linkedin.com
px.mountain.com
px.steelhousemedia.com
px4.ads.linkedin.com
s.ad.smaato.net
script.crazyegg.com
secure.adnxs.com
simplifi.partners.tremorhub.com
siteimproveanalytics.com
snap.licdn.com
stags.bluekai.com
static.ads-twitter.com
sync.1rx.io
sync.bfmio.com
sync.intentiq.com
sync.smartadserver.com
t.co
tag.simpli.fi
tags.inzynk.io
tags.srv.stackadapt.com
td.doubleclick.net
tmp.argusplatform.com
tr.outbrain.com
tracking.contanuity.com
tracking.crazyegg.com
trk.techtarget.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
wave.outbrain.com
webtracker.argusplatform.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
ad.doubleclick.net
loadm.exelator.com
s.ad.smaato.net
tracking.contanuity.com
104.19.148.8
104.244.42.3
107.178.254.65
108.138.128.14
13.107.42.14
142.250.64.66
142.250.65.228
142.250.80.104
142.250.81.230
142.251.40.130
142.251.40.226
15.197.193.217
151.101.44.157
157.240.241.1
172.217.165.134
172.66.0.227
172.67.163.237
18.209.0.122
184.50.205.247
23.105.12.120
23.34.59.26
23.51.57.192
2600:141b:1c00:209a::1e80
2600:141b:1c00:2e::17d1:48c5
2600:141b:1c00:6::17df:d120
2600:1901:0:8eee::
2600:1f18:1492:1702:852f:d87f:6683:b05a
2600:1f18:612b:4264:4138:d6ea:f3b0:2f1c
2600:9000:2512:3a00:12:dfa9:e200:93a1
2600:9000:26fa:5c00:19:fc2c:a140:93a1
2600:9000:26fa:a400:1b:6b7d:2300:93a1
2606:4700:3108::ac42:2af8
2606:4700:4400::ac40:9b77
2606:4700::6812:1347
2606:4700::6812:562a
2607:f8b0:4006:81e::2008
2607:f8b0:4006:81e::200e
2607:f8b0:4006:822::2002
2620:1ec:21::14
2620:1ec:33:1::10
2620:1ec:bdf::40
2a02:6ea0:c454::1
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42:600::485
3.135.83.200
3.94.188.245
34.111.113.62
34.111.208.231
34.117.77.79
34.193.229.172
34.194.162.5
34.196.140.205
34.200.65.202
34.86.110.8
35.194.66.159
35.244.154.8
35.244.159.8
35.71.139.29
35.81.162.201
44.209.137.118
44.209.251.198
44.212.189.233
44.215.158.120
44.225.29.129
44.226.187.177
44.235.191.156
52.3.138.212
52.32.164.86
52.6.142.3
54.203.236.163
63.140.39.150
63.140.39.9
63.251.28.210
64.202.112.191
68.67.179.164
68.67.181.211
69.173.151.100
69.194.240.13
74.121.140.211
8.28.7.83
99.83.231.3
03a0fcddc62f902b243bb6ed855041f4fa937340fd81d86552f672f24d6497da
0568e0aa0121606c8b5c5a959e6b8e80560642d4748f059f0bae1aafabdb9265
0968bbb30f1aef951bb770793756fca4fd75cce26bce318ace9c6e31deddf7f6
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0d41c18875dbfc417ec3cdb20d698edd52b930504892fe1e3dd1c0f1ba9b42f7
0d87642c368aa398fe4dd35af439768fb2c9167ba52f2b995eaa3d61598853a6
0e0c8cedb72a7e5a3080203509132486e267e5d1b0c5c6eae78ac16f7928ff01
0e6e31465592638aaa036384d85ebd6e6c56b9178591bceea4a0b815dd06d535
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
1362ad7199ef6585442f4cb16faba76503e5cf440ca0a82490f19497cd6a75bc
17095b0dfaded492b73f4f6a30412ecb2f7a87a2ebd1f8963d5c5cee3db937bd
17234dc33fee83a6097588da7dc802864fd9af021ff0b48fa73a404e30aa362c
18041a7dd2be9d4ba5469edca86d5bd763e3bdcae7a83c5559c618bf4be83f0f
188c1c4378ca30c9eef2b446a37c4a7eb75d043f56acf32c35eb0077bb8705a6
18e04370c6f2bee61d32771663e6b0408e1627bb89a3894457941fa19ad83000
18f5794db26670e34d8df06806be8536dc6520a380dcf67bced51fc8f7ef91e1
1a8491dacfaed6de53e20ff200c81255fb61def72f2696426a23ec5a05265b28
1bfc3fec636bdfc92ca324c43dc9382d5f1567b0cb29f806202c2ee530173b7e
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1d3e1ffd86a5653412775034689e08d77352a1a255038f3cf953b76318ac946a
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
26b37b2982358112ad578340484a7de6274a19db3fb6ea13f0b4e2d89e35f566
29d6b32f545f36a29ab83a4be5f92d4ebfb43a6dcc6457f7681a8478e5e8ea6c
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e50f9ae9324af2e1d1803215dfa3b1e4476f62bf1c3d548743835992ca87182
2e963b4b8f73348a8de67ca3f24258b1bfc6874339867af3119bd8751ad9db79
2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
36186e198e296c76785020a85f35312fbf538fe48f96b8358b01c25cb5b673e8
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
39a543197cee3bd0cac857a39467717e59781b5a8eec38ba40ebcc281e2c78b0
3ac2943bf8d9d7f8d3dfa505f1c382b028fa493ffb2e3e2145595815df4ee999
3c476709657631c6042c47b958d5d7f9bb098dfc56478420f47d9eae5df9c62c
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
443f47f0ae01cec5b4bc117dffb451485e147a54865efa7c820320e68cb55909
450be4bf64305ebda12eebbbbdba85912e51497cbb52f921dab64a44310a16b1
47e3fb300bd710551d6e3829db90920c956149275bf4ca5e43923ca256d8a384
4aa70a752741f88840c0ae6612f71b6220ac77080c263caa1682cee47d9b39da
4af5dacf19bc195010075d202d98f083a444a8572cbc1711fe39225928cb6be1
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4da8a6638ad70698ad3d01aa0ef124aebe35c297685c0796b174822f597b1d09
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
4e9aa67ca1f1ffe2c11e722079a58f1be803c9378468d6c019be53b1ffd26c6b
512c22cd351a348b420690acf963b4f4ccc9c39987a4cb03b4257311f502a209
55efcd9c7c8dc07e65a641a23760facd1b95fa530876ac2d2766e3247764ad3e
5607bc0b49036b5f13acf3f5767e0fb2fb947f5369bda253939e78e2b11f85b4
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5cde97a99252b4ad4fa0d3becd808a64e2b1946feef502515a47aab3f9110f7c
5f7c381eca2f132069a8514789e46793cf6f5886b523ac91db7e33c41182248d
5fa043f0c7d87051071a76bfcd9a59a537991943ba96fde8cc718c5a0919b45b
608f95c0544308eaef8ee3554248e93e668f323fb954f584ddc12cd65947d251
61917dc4b13b887a30af978c934892e7db4329ba72bbd655635613b537d760e5
61af4356b1a56a808fbe79a6cd0f96444069b54d9eb1a1576b45c0e0f6bae0c5
62ccea4549c1c360f561987e20bd929c475a5f596bc7731a224d99e0d253cfa0
643a52fac3e3aae163ef76ad0a2a088d2f31ac2552eff000edc1b495c8fbba32
644e98e4c6ce7519f77dc6c7401426d231c8f895f550c7f6c514bb4ec302ec6a
661e67a6ed119b9a5bd08892caf68b0e794f68207156cd50f703d320ee6155ef
66a9e8a80c33a2f932441adf709f92aecca67782c8c0c5b1e165584d7eb3a291
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552
6d4e2946e903d1003a0f566f287eede9a060c90212d8043a912e2a8d5ff86a64
6dc30577115228c8762ec07bf5b4c9930d9a283de985f0d78b86f9ae3eda32fd
7001f8d67c0a19ca456ca7dd12a3e4d139d9a3e2199d7e6f77c38f7929b8fb78
701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f
717f11c79608856a33546a50fe20ac984c44c933ba23ea02c851f8f0004df1fd
727d19bf895438013bb188825e546dd6e61f80c2a4ea8e7b6e978b96bab546f4
72a16e82ebbe48c45ef6e2a67f4645444081d0cb72e09324824fc123fc30f6a0
743115747771d84320f952e1f7a97507b9fc3657cd03ad6c86164f197e7c0c4c
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
7b8112efa2e817f2534339b1a48bf487e65a54d6e3c17ac91c61b7bfb396dc5d
7c37b5d2c568700acb5aa4d6fc9ece9bc0df8882dc473d944a854ade711a696c
7e0efb4f74f81b4ffa6866d5f24a568e6f8c20f8f6d0af96a6ce7a295d851716
80979b936a389e029f1d96f9b57e39257416add377d59a14c91708c48cc60ae2
835a378479e2f62ad60739025cac3f2a8b47ad3aeed886d877fcaad17ee4e463
86c482514cb9ce866c395eb8581dd77ec328b19bee3ed77a1c826f3bbdcdf1e4
872f233ef34c09bfa33644108af6f2dfce8f77a0e2dc0847882840355efc4820
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
8af6fb23ba1c0a4860476b240ba2d05c02ff018f1a93d2caadf7301ed87223d7
8c0aa54f351ccf9f614ac7519cec00ae1f40db7bbea8c7dd2fb51538a8d9b272
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8ef9e9b7103e38d4509a125612dad3ff98edfd671fa45f01d4d09c3cefa50a8f
8f908e9df5b54233e81476beca89f1587a0158cd77602fd1bf082d5ac6e054e4
90a224ae782e3be06cc08cd0dea598ea22f91ee4635920cc77228326bb5409d4
91aff3588efba0074124bbd204b45de0da882a853f29a1d73f7ec132291c5651
91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f
924650c7a17eeebee4e6d6c734cdc04a1f259a2775cf53352f781d567798e60d
92cfae0b0d343d93e5e1d365bb9179904e50407d803588ec009e2bb19e211ea3
930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6
931a1bc91c7b780d9df916bdbd551447e2b0d742a0ff1bdd7a6dbb5f42619b39
933ddaeb7b389ab0803e3e7a1124cd51dcd097514e5e1cff4d4cef50b219779e
94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66
9636ce7f4b06bd40058b0417691448095e6490a3b518fbdeac3e104023fd9b92
96fa0a3199b1184d9aab3b1a117e7b88974daff72641aee7f50b44f80d404aa4
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d
9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a127f5d38a4a71d09b04fe89ab3c7cea05b5d20997a702855f66bcf3c0393cd5
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a23b68a0964626bb4062bf726dd4ab52d438dcfb88991402b224146d1087d1a7
a364f8998ea88f243a482109d256626e8d7cb72a05eac69ac608c27435241a65
a462bb85392ef235bc0ab080e8a9ae078a228fb74b3df156cb9f3ce7e20ad9e6
a4db214a51d8aa0b6a55aab329c983c0dba1976db88c499c75410392e220f9e5
a9a345b743fb7460be8d7e10ca085ea57901980b67d43151196d36f94a5451cb
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad15ab06d640d365a00d41e146660addb01348b2f6878f6ffdc1dc428c67cc19
b0b526b901a7afeac92efcd87a441305a26891bba8bfbb950f4b18f7fd582e59
b0c24ca8333c5e792fdbb0d0a02529e99999ae19484c6e304c4cc8ce4535d485
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15
b3f4fd3661f04c2c6374215073e85cb8c5c938ee783677f40e85151989c39d97
b49d6ac6e025c44ccc97f72337d6484cb6e4ac502baed0f76a0415d90847e24e
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e
b69b5763c6c912b8a1852981c4401647963d63734e234b073d97c0dffbf64206
b6b5c482335d9f81dad2b8bc8e56fb1cf28c0a704f99de75ff04a334b5880355
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bb13a80fdd4875e6626de9e2b4ebf7948f3cfe191f73b4dbf31e1247d0239667
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bbbe4c355190af010804b37a13086dbb5dc6cb763a70496d80946c978076693c
bc639cf58861c784d58cc39a9122f666fe15163dcd4c96004486d68f7c3c397f
bd6f701d7b3abd41679f87c496bc8911a602f247900dfc7ab7cb3a62abe098ee
be6a4e807436b64099a97e3a4c3647c66628797d9de9c3f81140cdd2a2a798c5
bec3437c8baa45a6344648c2bb6806831972c5cdd7ae34a16897d6e205092476
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869
c153cd2dff5ec3af05397a2fe0f7dc1eb7544b5858521dca8bf1c20e439d70d4
c3be590171c0375d497714a608a5c4cd4e90e124e1c0cff1807cd8adb156e64b
c50c3a763973b8bc75e126c3f104f84a728f8febf50faa7e37685e86fa1e2c1b
c584b5d0f98a654a3857877fa1e3dbb85b0b0e779191ad952af4e14116205e2c
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86
c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59
c86f2ad57b3a3d9647b3415383ed7d8426619fec423e97629abefe8351a505bf
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cbe67b5b6fa27d2f9d4f18dba4f940ce8c4a3dbcab1541b5b1023ce4dcea66e0
ccb5e7cd791c0fe26d7130402378ba7ac7de583a93285ec5258535eb1aef114a
cdb5dd11cc2d54154d78749eca731e4a7909d178949b5cfbed105545f8a5cfa6
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cff43ffcd3d9feaba4fb1250d800a3b9650a7f65c26f00b196e403cc763ee1d4
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d149f99e38895c0c719de767174e8936f8086a90dffde561e2db9f40f735c345
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d3cdd8255b0cabf4568ec33c19f12ef6a3a761ea27bb36f0e1a12d9c4f31a2f5
d4edec0e6d150110e180ad38f47e5eab79358d5df97f12e15c73a4b538863451
d5dc4157271c9d3147055b0f2b85578271417af24cb1cfd197b84194ddaa0bfa
d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
df2ea3183c9d9074c41a16483a9b0ac48c0d60b41657de1ded16c7743313f8fd
e0ddca762f4308a8f15b047f5388caebbdc43d87913df1b174b9e279cb1c275e
e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e43a78cb528d99356d4426d8975072a19dbbbd71273d0d746f1287a2696d6853
e91d19121fbf6ef08ec7ce270a07ef60a36ee454268228a0d698f666c2d9f359
ec5a240780ab83205367dfb9274a408269d2a10d837164fe39eebabd757d9e7e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
eff032f2a7c04897a921492a9ce71e4fcbd047f1b2b487177955f000d6a182d6
f02faad1987312daa96dcd532794b6db4faa8a623306821b9d26235dbea36983
f21e3a5a80821feb91e7bb84d525742fd137c4b336f3ff3f1bb15dc2fcae9d70
f26ae51e214125767e456bc97f886b908749c984035ab7d7432fb11031a2a8e3
f46a9869eb1b18c3d0274a6ab46008bb2cfaa73cc3fbb25df8e2d6085ad706da
f53109bc9c1f5eba5a8e47a82b8a8e12de6fdd2c81f0a5320d5cd457708a5324
f797f871bec64d4d54308abab8c7008df6b855a83b59dbc17665e3c4111e7032
f871c964f40da218d1b13f30f6bc5fa20910627b7a098971b587c163b09010c3
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.fortinet.com Open in urlscan Pro 2600:1f18:1492:1702:852f:d87f:6683:b05a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

235 Requests

85 %HTTPS

27 %IPv6

63 Domains

90 Subdomains

74 IPs

2 Countries

6438 kBTransfer

10291 kBSize

122 Cookies

15 Outgoing links

Redirected requests

235 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1702:852f:d87f:6683:b05a Public Scan

Screenshot
Live screenshot

Full Image

235
Requests

85 %
HTTPS

27 %
IPv6

63
Domains

90
Subdomains

74
IPs

2
Countries

6438 kB
Transfer

10291 kB
Size

122
Cookies

235 HTTP transactions
3 data transactions