urlscan.io logo urlscan.io
SecurityTrails logo

www.fortinet.com Open in urlscan Pro
52.52.145.59  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Submission: On May 06 via api from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 26 IPs in 5 countries across 16 domains to perform 49 HTTP transactions. The main IP is 52.52.145.59, located in San Jose, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on March 19th 2019. Valid for: 2 years.
This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 52.52.145.59 16509 (AMAZON-02)
4 2.19.43.118 20940 (AKAMAI-ASN1)
7 104.111.217.111 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 3 54.72.80.76 16509 (AMAZON-02)
1 52.8.142.247 16509 (AMAZON-02)
1 2.16.186.243 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
1 52.211.104.45 16509 (AMAZON-02)
1 4 172.82.235.45 15224 (OMNITURE)
1 1 66.117.28.86 15224 (OMNITURE)
1 52.213.106.142 16509 (AMAZON-02)
1 34.203.158.69 14618 (AMAZON-AES)
2 104.111.214.206 16625 (AKAMAI-AS)
1 2a02:26f0:f1:... 20940 (AKAMAI-ASN1)
2 23.111.9.217 33438 (HIGHWINDS2)
1 50.17.52.222 14618 (AMAZON-AES)
1 3 18.184.119.244 16509 (AMAZON-02)
1 165.227.67.158 14061 (DIGITALOC...)
2 178.128.135.232 14061 (DIGITALOC...)
1 2 172.82.228.19 15224 (OMNITURE)
1 66.117.29.6 15224 (OMNITURE)
1 46.51.181.97 16509 (AMAZON-02)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 54.246.124.93 16509 (AMAZON-02)
2 3 2620:119:50e2... 14413 (LINKEDIN)
1 1 2a05:f500:11:... 14413 (LINKEDIN)
49 26
7    52.52.145.59 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-52-145-59.us-west-1.compute.amazonaws.com
www.fortinet.com
4    2.19.43.118 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-43-118.deploy.static.akamaitechnologies.com
platform-api.sharethis.com
buttons-config.sharethis.com
platform-cdn.sharethis.com
7    104.111.217.111 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-217-111.deploy.static.akamaitechnologies.com
assets.adobedtm.com
1    2a00:1450:4001:824::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
3    54.72.80.76 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-72-80-76.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    52.8.142.247 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-8-142-247.us-west-1.compute.amazonaws.com
www.fortinet.com
1    2.16.186.243 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-243.deploy.static.akamaitechnologies.com
c.sharethis.mgr.consensu.org
3    2a00:1450:4001:81f::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    52.211.104.45 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-211-104-45.eu-west-1.compute.amazonaws.com
fortinet.demdex.net
4    172.82.235.45 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: fortinet.com.ssl.sc.omtrdc.net
metrics.fortinet.com
1    66.117.28.86 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
cm.everesttech.net
1    52.213.106.142 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-213-106-142.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    34.203.158.69 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-203-158-69.compute-1.amazonaws.com
count-server.sharethis.com
2    104.111.214.206 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-214-206.deploy.static.akamaitechnologies.com
s.adroll.com
1    2a02:26f0:f1:28a::3adf (European Union)

ASN20940 (AKAMAI-ASN1, US)
sjs.bizographics.com
2    23.111.9.217 (Phoenix, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
a.optmnstr.com
1    50.17.52.222 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-50-17-52-222.compute-1.amazonaws.com
api.opmnstr.com
3    18.184.119.244 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-184-119-244.eu-central-1.compute.amazonaws.com
l.sharethis.com
1    165.227.67.158 (New York, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
a.mstrlytcs.com
2    178.128.135.232 (Greece)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
z.opmnstr.com
2    172.82.228.19 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: *.sc.omtrdc.net
fortinetinc.sc.omtrdc.net
1    66.117.29.6 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
fortinet.tt.omtrdc.net
1    46.51.181.97 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-46-51-181-97.eu-west-1.compute.amazonaws.com
d.adroll.com
1    2a03:2880:f01c:20e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
graph.facebook.com
1    54.246.124.93 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-246-124-93.eu-west-1.compute.amazonaws.com
d.adroll.com
3    2620:119:50e2:105::6cae:b35 (United States)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
px.ads.linkedin.com
1    2a05:f500:11:101::b93f:9001 (Ireland)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
www.linkedin.com
Domain Requested by
8 www.fortinet.com www.fortinet.com
7 assets.adobedtm.com www.fortinet.com
assets.adobedtm.com
4 metrics.fortinet.com 1 redirects www.fortinet.com
4 dpm.demdex.net 1 redirects www.fortinet.com
3 px.ads.linkedin.com 2 redirects
3 l.sharethis.com 1 redirects www.fortinet.com
3 www.google-analytics.com www.googletagmanager.com
www.fortinet.com
2 d.adroll.com s.adroll.com
www.fortinet.com
2 fortinetinc.sc.omtrdc.net 1 redirects www.fortinet.com
2 z.opmnstr.com a.optmnstr.com
2 a.optmnstr.com www.googletagmanager.com
www.fortinet.com
2 s.adroll.com www.googletagmanager.com
s.adroll.com
2 platform-cdn.sharethis.com www.fortinet.com
1 www.linkedin.com 1 redirects
1 graph.facebook.com platform-api.sharethis.com
1 fortinet.tt.omtrdc.net assets.adobedtm.com
1 a.mstrlytcs.com a.optmnstr.com
1 api.opmnstr.com a.optmnstr.com
1 sjs.bizographics.com www.googletagmanager.com
1 count-server.sharethis.com platform-api.sharethis.com
1 cm.everesttech.net 1 redirects
1 fortinet.demdex.net assets.adobedtm.com
1 c.sharethis.mgr.consensu.org platform-api.sharethis.com
1 www.googletagmanager.com www.fortinet.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 platform-api.sharethis.com www.fortinet.com
49 26
Subject Issuer Validity Valid
www.fortinet.com
DigiCert SHA2 High Assurance Server CA		 2019-03-19 -
2021-06-09		 2 years crt.sh
*.sharethis.com
DigiCert SHA2 Secure Server CA		 2018-12-16 -
2020-03-16		 a year crt.sh
assets.adobedtm.com
DigiCert SHA2 High Assurance Server CA		 2019-03-04 -
2020-03-11		 a year crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-04-16 -
2019-07-09		 3 months crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA		 2018-01-09 -
2021-02-12		 3 years crt.sh
*.sharethis.mgr.consensu.org
DigiCert ECC Secure Server CA		 2018-07-31 -
2019-07-31		 a year crt.sh
metrics.fortinet.com
DigiCert SHA2 High Assurance Server CA		 2019-01-29 -
2021-02-02		 2 years crt.sh
*.adroll.com
DigiCert SHA2 Secure Server CA		 2018-12-19 -
2020-03-19		 a year crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA		 2018-04-13 -
2020-04-17		 2 years crt.sh
*.optmnstr.com
Go Daddy Secure Certificate Authority - G2		 2018-07-10 -
2020-07-10		 2 years crt.sh
*.opmnstr.com
Go Daddy Secure Certificate Authority - G2		 2019-04-11 -
2021-04-11		 2 years crt.sh
*.mstrlytcs.com
Go Daddy Secure Certificate Authority - G2		 2017-08-25 -
2019-08-25		 2 years crt.sh
z.opmnstr.com
Let's Encrypt Authority X3		 2019-04-11 -
2019-07-10		 3 months crt.sh
*.sc.omtrdc.net
DigiCert SHA2 High Assurance Server CA		 2019-04-23 -
2020-04-14		 a year crt.sh
*.tt.omtrdc.net
DigiCert SHA2 High Assurance Server CA		 2017-10-19 -
2020-11-25		 3 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-03-08 -
2019-06-06		 3 months crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2017-06-06 -
2019-06-11		 2 years crt.sh

This page contains 6 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Frame ID: 336645D794991029C293F473312C6E37
Requests: 46 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: B975DC6E9931B50BB8CC8E6831A483F3
Requests: 1 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 5A7BFD061D7A8CB71AB8804ACF1F196A
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
Frame ID: 32417296C35744AC8101821093046B7A
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
Frame ID: F3D12730ED919809A5C5D6604D627053
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
Frame ID: 2AA94AABB3EC7121232771820C9F2DF9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /(?:a|s)\.adroll\.com/i
  • env /^adroll_/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i
Overall confidence: 100%
Detected patterns
  • script /\/s[_-]code.*\.js/i
  • env /^s_(?:account|objectID|code|INST)$/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

49
Requests

100 %
HTTPS

22 %
IPv6

16
Domains

26
Subdomains

26
IPs

5
Countries

1973 kB
Transfer

2977 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557155051648 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557155051648
Request Chain 19
  • https://metrics.fortinet.com/id?d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823 HTTP 302
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823&AQE=1
Request Chain 20
  • https://cm.everesttech.net/cm/dd?d_uuid=21875687818642250953230339003800766164 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNBM6wAAE7wSsxKk
Request Chain 33
  • https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=www.fortinet.com&location=%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&product=sticky-share-buttons&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&source=sharethis.js&fcmp=false&title=Patch%20Your%20Microsoft%20Windows%20and%20Office%3A%20Fortinet%20Discovers%20Three%20Zero-Day%20Remote%20Code%20Execution%20Vulnerabilities&publisher=5977d47080bb1d0011ab6d8f&ts1557155051332=&sop=true HTTP 301
  • https://l.sharethis.com/sc?cm=ZGAWm1zQTOwAAAATOcumAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&sop=true
Request Chain 41
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823&AQE=1 HTTP 302
  • https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823&AQE=1
Request Chain 49
  • https://px.ads.linkedin.com/collect/?time=1557155054465&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&fmt=js&s=1 HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1557155054465&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&fmt=js&s=1&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557155054465%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html%26fmt%3Djs%26s%3D1%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1557155054465&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&fmt=js&s=1&cookiesTest=true&liSync=true

49 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
www.fortinet.com/blog/threat-research/ 		29 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
a0b376a73b48e8b75e96ca3f5ac6521a3687cd5fdee7963d63793f8d6dd7616f
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
www.fortinet.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=600, public
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 06 May 2019 15:04:11 GMT
ETag
"72a2-588393f59f643-gzip"
Last-Modified
Mon, 06 May 2019 14:52:20 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Vary
Accept-Encoding,User-Agent
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Length
7102
Connection
keep-alive
clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		211 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
eb6058ea8eec777d07e89407b55de7990eb296b3f5a5ee4a6b04c71d3c129c42
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:11 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:26:14 GMT
Server
Apache
ETag
"34d65-5878de44ddd80-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
text/css
Cache-Control
max-age=43200, public
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Length
16858
X-XSS-Protection
1; mode=block
sharethis.js
platform-api.sharethis.com/js/ 		91 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:11 GMT
Content-Encoding
gzip
ETag
W/"16d4e-SgmVDK5mv+C+DRaEIjQ3WYUSiQ4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Content-Length
27855
satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		144 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f2bf5964adbfac80827ae87c5f7c0f05e51f416e3e2132fd93dc2e2d98f2e935

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 15:04:11 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"479d7011b674847178716d558563c2d3:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 06 May 2019 16:04:11 GMT
fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 		32 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:29:19 GMT
Server
Apache
ETag
"7ebb-5878def54bdc0-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Length
1998
X-XSS-Protection
1; mode=block
clientlib-base.min.js
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		165 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
85c6103aabd94bf4584fbdd8b15cb68c08fa52f43dc229ac034a1bf6c855c0bc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:11 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:27:24 GMT
Server
Apache
ETag
"2931b-5878de879fb00-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/javascript
Cache-Control
max-age=43200, public
transfer-encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
X-XSS-Protection
1; mode=block
5977d47080bb1d0011ab6d8f.js
buttons-config.sharethis.com/js/ 		444 B
865 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/5977d47080bb1d0011ab6d8f.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
7f0daa7591ef2b42b26dd9d39102440c242e7fd798e7898a620e5489d67ec73e

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:11 GMT
Last-Modified
Tue, 16 Jan 2018 20:14:52 GMT
Server
AmazonS3
x-amz-request-id
33BF777283B6DCED
ETag
"6167cc13570c31ffc1713616a6fb087d"
Content-Type
text/javascript
Cache-Control
public, max-age=60
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
444
x-amz-id-2
hsILMaWrKRvq3dU3rIiiMpbXCpEB1o2SKOTVgl6vRXE0vKuZmuHru/osDcmeuqMHuHCSYNUlvNc=
gtm.js
www.googletagmanager.com/ 		60 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
604ae5068c06ac47597ed7e1c587a0ce7d8ff6e8174a979b285169f1b3277016
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 15:04:11 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 22:14:49 GMT
server
Google Tag Manager (scaffolding)
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
23009
x-xss-protection
0
expires
Mon, 06 May 2019 15:04:11 GMT
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557155051648
  • https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557155051648
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557155051648
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.72.80.76 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-80-76.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Location
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557155051648
X-TID
7jzIv/T/T7E=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Access-Control-Allow-Origin
https://www.fortinet.com
X-TID
7jzIv/T/T7E=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557155051648
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		75 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bf37dba5836581c0cc0451edd5c197e46a5a0e070b3f696e5b4bf7e32da1817a

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 06 May 2019 15:04:11 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"eb6d969848d866a39a78150c4a347735:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
27590
expires
Mon, 06 May 2019 16:04:11 GMT
truncated
/ 		71 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/png
microsoft-blog-hero.png
www.fortinet.com/content/dam/fortinet-blog/article-images/lockergoga-blog/ 		1 MB
1 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/lockergoga-blog/microsoft-blog-hero.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
2d95e9cd3ff86f203b97db941503341afcf1edb03fde6ad8da1e8fe8c662bedd
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:12 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:58:15 GMT
Server
Apache
ETag
"137ece-5878e56cdffc0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1277646
X-XSS-Protection
1; mode=block
hong_01b.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/microsoft_windows_jet_engine_msrd-/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/microsoft_windows_jet_engine_msrd-/hong_01b.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
41cd14971fd10dbeb7ddacf6c792a2f40fb62cfbb36a725a1cb02dfb9c165206
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:12 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Mon, 29 Apr 2019 01:33:26 GMT
Server
Apache
ETag
"6834-587a145516580"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
26676
X-XSS-Protection
1; mode=block
analysis-cve-2018-0797-hero-thumbnail.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/a-root-cause-analysis-of-cve-2018-0797---rich-text-format-stylesheet-use-after-free-vulnerability/ 		239 KB
239 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/a-root-cause-analysis-of-cve-2018-0797---rich-text-format-stylesheet-use-after-free-vulnerability/analysis-cve-2018-0797-hero-thumbnail.jpg.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
17853c0cd1ce0a2b1a11885854920b9d1e7899bcb98bef49930ba54c069ba354
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:12 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 03:15:23 GMT
Server
Apache
ETag
"3bbcb-5878e941408c0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
244683
X-XSS-Protection
1; mode=block
windows_02.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/microsoft_windows_remote_kernel_crash_vulnerability/ 		42 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/microsoft_windows_remote_kernel_crash_vulnerability/windows_02.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
f9653b3215f496b0d1e36068d49cdaab0a66b305055197147e4e73d226ee162e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:12 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 08:42:05 GMT
Server
Apache
ETag
"a7ad-587932472d140"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
42925
X-XSS-Protection
1; mode=block
portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame B975 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.243 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-243.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
c.sharethis.mgr.consensu.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
ETag
W/"26b-4977387000"
Last-Modified
Tue, 01 Jan 1980 00:00:00 GMT
Vary
Accept-Encoding
Content-Length
334
Cache-Control
public, max-age=3600
Date
Mon, 06 May 2019 15:04:12 GMT
Connection
keep-alive
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
5502
date
Mon, 06 May 2019 13:32:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17543
expires
Mon, 06 May 2019 15:32:29 GMT
collect
www.google-analytics.com/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=720410669&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&ul=en-us&de=UTF-8&dt=Patch%20Your%20Microsoft%20Windows%20and%20Office%3A%20Fortinet%20Discovers%20Three%20Zero-Day%20Remote%20Code%20Execution%20Vulnerabilities&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAAAB~&jid=1483775297&gjid=2000881675&cid=1797580716.1557155052&tid=UA-767980-6&_gid=1466216008.1557155052&_r=1&gtm=2wg430NBSLLPJ&z=422911676
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 May 2019 15:04:11 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
rd
dpm.demdex.net/id/ 		367 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557155051648
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.72.80.76 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-80-76.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
57eb0a277e2d3a3261a0252bafaca6eb8d6d8cc2ca4e0ef625a6eff980af31a9

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Origin
https://www.fortinet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v028-03f70f258.edge-irl1.demdex.com 5.52.1.20190424113352 5ms
Pragma
no-cache
Content-Encoding
gzip
X-TID
KqEtnyJIQC4=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
303
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Cookie set dest5.html
fortinet.demdex.net/ Frame 5A7B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://fortinet.demdex.net/dest5.html?d_nsid=0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.211.104.45 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-211-104-45.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
fortinet.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Accept-Encoding
gzip, deflate, br
Cookie
demdex=21875687818642250953230339003800766164
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Thu, 25 Apr 2019 10:10:47 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=21875687818642250953230339003800766164;Path=/;Domain=.demdex.net;Expires=Sat, 02-Nov-2019 15:04:11 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
iiyL0XMnSLw=
Content-Length
2764
Connection
keep-alive
id
fortinetinc.sc.omtrdc.net/
Redirect Chain
  • https://metrics.fortinet.com/id?d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:12 GMT
X-Content-Type-Options
nosniff
Access-Control-Allow-Origin
https://www.fortinet.com
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 15:04:12 GMT
Server
Omniture DC
xserver
www288
Content-Type
text/plain
Location
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823&AQE=1
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Keep-Alive
timeout=15
Expires
Sun, 05 May 2019 15:04:12 GMT

Redirect headers

Date
Mon, 06 May 2019 15:04:12 GMT
X-Content-Type-Options
nosniff
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 15:04:12 GMT
Server
Omniture DC
xserver
www288
Location
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823&AQE=1
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Keep-Alive
timeout=15
Expires
Sun, 05 May 2019 15:04:12 GMT
ibs:dpid=411&dpuuid=XNBM6wAAE7wSsxKk
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=21875687818642250953230339003800766164
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNBM6wAAE7wSsxKk
42 B
769 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNBM6wAAE7wSsxKk
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.106.142 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-213-106-142.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v028-07251281e.edge-irl1.demdex.com 5.52.1.20190424113352 3ms
Pragma
no-cache
X-TID
mOkkp3cgQjw=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date
Mon, 06 May 2019 15:04:11 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNBM6wAAE7wSsxKk
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
satellite-5aa864a164746d58b700412b.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame 3241 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html

Response headers

status
200
server
Apache
etag
"52fa849a16651953dc915efbae88d0cc:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
803
cache-control
max-age=3600
expires
Mon, 06 May 2019 16:04:12 GMT
date
Mon, 06 May 2019 15:04:12 GMT
timing-allow-origin
*
satellite-5aa864f264746d7629003a65.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame F3D1 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html

Response headers

status
200
server
Apache
etag
"8227658d1e33b9eaa91028e35c3beb4f:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
782
cache-control
max-age=3600
expires
Mon, 06 May 2019 16:04:12 GMT
date
Mon, 06 May 2019 15:04:12 GMT
timing-allow-origin
*
satellite-5aa8640864746d58b700411f.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame 2AA9 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html

Response headers

status
200
server
Apache
etag
"94b6dd03c710fe7140881c36dbb5ab47:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
899
cache-control
max-age=3600
expires
Mon, 06 May 2019 16:04:12 GMT
date
Mon, 06 May 2019 15:04:12 GMT
timing-allow-origin
*
s-code-contents-678d604999b9203058dbe982c7a7ddbf795bb1f4.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/s-code-contents-678d604999b9203058dbe982c7a7ddbf795bb1f4.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
68588db4f09f1982d74887644c54e581cc6ed7e267f836a480c29ef1a3c0a7a0

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 15:04:12 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"9a1e762486f8afef7a6f384a1e9c253d:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
13170
expires
Mon, 06 May 2019 16:04:12 GMT
satellite-59ceae2064746d21fe0037dd.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ 		1 KB
693 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-59ceae2064746d21fe0037dd.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
24038492cb3d19fef34ce0a9bc55033f3030c04eeea97a93c22b2ec8914c1316

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 15:04:12 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
server
Apache
etag
"d8619d86a5e27900726ec96a76ead3cc:1556235289"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
459
expires
Mon, 06 May 2019 16:04:12 GMT
get_counts
count-server.sharethis.com/v2.0/ 		306 B
391 B 		Script
General
Check archive.org
Download Go to
Full URL
https://count-server.sharethis.com/v2.0/get_counts?cb=window.__sharethis__.cb3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&refDomain=www.fortinet.com&sop=true
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.158.69 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-203-158-69.compute-1.amazonaws.com
Software
/
Resource Hash
3bef5c13ae0f633b1f8ae82eff69129499299192d57382d109f447daa5888bbf

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:13 GMT
Content-Encoding
gzip
Connection
keep-alive
Content-Length
234
Content-Type
application/json
arrow_left.svg
platform-cdn.sharethis.com/img/ 		565 B
949 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_left.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:13 GMT
Last-Modified
Fri, 04 Jan 2019 18:31:05 GMT
Server
AmazonS3
x-amz-request-id
94F2D426BC40202E
ETag
"b55d8d2b9321e381a3c38a4bddb74037"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
565
x-amz-id-2
Uww4MQkmv7/18yxD65bZ7kOF5bESMIIobEwzMpmtLohEtZ7EZWpzaoCZnMmhTqTRvUbCb/2aPYA=
arrow_right.svg
platform-cdn.sharethis.com/img/ 		565 B
949 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_right.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:13 GMT
Last-Modified
Fri, 04 Jan 2019 18:31:05 GMT
Server
AmazonS3
x-amz-request-id
BECE9179367F8EC9
ETag
"9928d025bd5792b718ee0a185f62e67c"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
565
x-amz-id-2
h6lE2cepykY/qBF4SDzfV/ywkiWBvlLZQDlhK1dJRZKTE3psDaN74Cvr4MIculViiryAUjznxuY=
roundtrip.js
s.adroll.com/j/ 		32 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.206 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-206.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6d73aa32774fb131ebbc1faf3f931aaf66e998f808757cbafbcc737f8d769580

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
ea1u3hYQrubY64bATByV7XbdUEwnubrR
Content-Encoding
gzip
x-amz-request-id
78178995BFA9B911
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 06 May 2019 15:04:13 GMT
Connection
keep-alive
Content-Length
10245
x-amz-id-2
k4ljptkHWQEn1gZQXBAd3ucQCD6jaG5iq1H5yya9xUOVRXeJ6GzAj5lH6PSn8x3O3b/1vsM/aXI=
Last-Modified
Wed, 20 Feb 2019 19:22:50 GMT
Server
AmazonS3
ETag
"a75c16aa500b21e32e06699919372ec4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
insight.min.js
sjs.bizographics.com/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:f1:28a::3adf , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:12 GMT
Content-Encoding
gzip
Last-Modified
Mon, 03 Dec 2018 23:03:30 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=47602
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4571
api.min.js
a.optmnstr.com/app/js/ 		176 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.optmnstr.com/app/js/api.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
696bac8666ce5bf4e390c7f71dc783a17fb56a3b429c6ff35dd5ad52ae254988

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 15:04:12 GMT
content-encoding
gzip
last-modified
Wed, 01 May 2019 20:28:04 GMT
server
NetDNA-cache/2.2
x-amz-request-id
0EB5603AAEA8151F
etag
W/"893ec539b14306fc6cd144c53e9daa66"
x-cache
HIT
content-type
application/javascript
status
200
cache-control
max-age=2592000
x-amz-id-2
Ux9RiJdNMR2AUJqZZSbvaCtZV3cyg4JI/s5J2WQp5hO18lqTnuTUQt35CUa7jJRMX6BPMKjZS+M=
expires
Wed, 05 Jun 2019 15:04:12 GMT
39852
api.opmnstr.com/v2/embed/ 		163 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.opmnstr.com/v2/embed/39852
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.17.52.222 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-17-52-222.compute-1.amazonaws.com
Software
Pagely Gateway/1.5.1 /
Resource Hash
04c7fc62027de4c79f20a877f16b3fe9ecc2c45c647cb632b92f0d442784991c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Origin
https://www.fortinet.com

Response headers

x-user-agent
standard
content-encoding
gzip
x-cache-config
0 0
server
Pagely Gateway/1.5.1
status
200
date
Mon, 06 May 2019 15:04:12 GMT
x-cache-status
HIT
vary
Accept-Encoding, User-Agent
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-OptinMonster-Account
access-control-allow-headers
X-CSRF-Token
x-optinmonster-account
45602
sc
l.sharethis.com/
Redirect Chain
  • https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=www.fortinet.com&location=%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&...
  • https://l.sharethis.com/sc?cm=ZGAWm1zQTOwAAAATOcumAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&s...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/sc?cm=ZGAWm1zQTOwAAAATOcumAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&sop=true
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.119.244 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-184-119-244.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:12 GMT
Location
/sc?cm=ZGAWm1zQTOwAAAATOcumAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&sop=true
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
228
Stid
ZGAWm1zQTOwAAAATOcumAw==

Redirect headers

Date
Mon, 06 May 2019 15:04:12 GMT
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location
/sc?cm=ZGAWm1zQTOwAAAATOcumAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&sop=true
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
228
Stid
ZGAWm1zQTOwAAAATOcumAw==
b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
a.optmnstr.com/users/df0603609574/images/ 		78 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.optmnstr.com/users/df0603609574/images/b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
c001e01a6b6a23f4619521bb9a5cdea66124971ab04cf0211649015b0c4af1b1

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 15:04:12 GMT
x-amz-request-id
A72C287067CE6966
x-cache
HIT
status
200
x-amz-meta-date
1550704192
content-length
79452
x-amz-id-2
slvpkKABbzI4epoFWAmFMjSGt4+l253KuFjJHitlCw+Z+7RSFY1Qo4uBRbvNAWKCT8sjvd6IhTw=
x-amz-meta-level
pro
last-modified
Wed, 20 Feb 2019 23:09:53 GMT
server
NetDNA-cache/2.2
x-amz-meta-accountid
45602
etag
"fc7ddf45e300c64bfc4cb7ddc8c325c8"
content-type
image/jpeg
x-amz-meta-userid
39852
x-amz-meta-title
b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
cache-control
max-age=2592000
accept-ranges
bytes
expires
Wed, 05 Jun 2019 15:04:12 GMT
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dbeeb3fa5f0188835b6b6208bc89d641f030e79e27ad5712d427eabd79e6095a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/png
a
a.mstrlytcs.com/v1/ 		0
132 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://a.mstrlytcs.com/v1/a?ty=impression&aid=39852&cid=41325&sid=81773&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
165.227.67.158 New York, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Origin
https://www.fortinet.com

Response headers

status
200
date
Mon, 06 May 2019 15:04:12 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.fortinet.com
content-type
text/plain; charset=UTF-8
q
z.opmnstr.com/v2/ 		0
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://z.opmnstr.com/v2/q?aid=39852&cid=qxx1b0gslklfu2kjckea&sid=5ab4105aee546&gaid=1306710&gas=5ab42b3012fe2&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.128.135.232 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
kong/0.14.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Origin
https://www.fortinet.com

Response headers

Access-Control-Allow-Origin
https://www.fortinet.com
Date
Mon, 06 May 2019 15:04:12 GMT
Access-Control-Allow-Credentials
true
Server
kong/0.14.1
Connection
keep-alive
i
z.opmnstr.com/v3/ 		0
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://z.opmnstr.com/v3/i?aid=39852&cid=qxx1b0gslklfu2kjckea&sid=5ab4105aee546&rt=false&dv=desktop&cty=inline&url=blog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.128.135.232 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
kong/0.14.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Origin
https://www.fortinet.com

Response headers

Access-Control-Allow-Origin
https://www.fortinet.com
Date
Mon, 06 May 2019 15:04:12 GMT
Access-Control-Allow-Credentials
true
Server
kong/0.14.1
Connection
keep-alive
collect
www.google-analytics.com/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=720410669&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&ul=en-us&de=UTF-8&dt=Patch%20Your%20Microsoft%20Windows%20and%20Office%3A%20Fortinet%20Discovers%20Three%20Zero-Day%20Remote%20Code%20Execution%20Vulnerabilities&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Blog%20-%20Threat%20Research&ea=impression&el=qxx1b0gslklfu2kjckea&_u=6HDAAEAB~&jid=1123490799&gjid=932884732&cid=1797580716.1557155052&tid=UA-767980-1&_gid=1466216008.1557155052&_r=1&z=1519340604
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 May 2019 15:04:12 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
sc
l.sharethis.com/ 		52 B
475 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/sc?cm=ZGAWm1zQTOwAAAATOcumAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&sop=true
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.119.244 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-184-119-244.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
94e12db37d01c4b0f8029d72f97d681aeb51fe066c95dde62c84ac3b133dbadf

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Origin
https://www.fortinet.com

Response headers

Date
Mon, 06 May 2019 15:04:12 GMT
Access-Control-Max-Age
1728000
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Stid
ZGAWm1zQTOwAAAATOcumAw==
Access-Control-Allow-Headers
*
Content-Length
52
id
metrics.fortinet.com/
Redirect Chain
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote...
  • https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-r...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.228.19 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
*.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:13 GMT
X-Content-Type-Options
nosniff
Access-Control-Allow-Origin
null
P3P
CP="This is not a P3P policy"
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 15:04:13 GMT
Server
Omniture DC/2.0.0
xserver
www131
Content-Type
text/plain
Location
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823&AQE=1
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Expires
Sun, 05 May 2019 15:04:13 GMT

Redirect headers

Date
Mon, 06 May 2019 15:04:13 GMT
X-Content-Type-Options
nosniff
P3P
CP="This is not a P3P policy"
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 15:04:13 GMT
Server
Omniture DC/2.0.0
xserver
www131
Location
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823&AQE=1
Content-Type
text/plain
Access-Control-Allow-Origin
null
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Expires
Sun, 05 May 2019 15:04:13 GMT
id
metrics.fortinet.com/ 		49 B
391 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=22241934778104813593193714239135049564&ts=1557155051823&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
624fb66a132f5828e22be5efae5cf887bee492c4d89d910d40c936e2f5ed2fb9

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Origin
null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Mon, 06 May 2019 15:04:13 GMT
Server
Omniture DC
xserver
www240
Vary
Origin
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Access-Control-Allow-Origin
null
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/x-javascript
Keep-Alive
timeout=15
Content-Length
49
s1851455922661
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.10.0-D7QN/ 		43 B
616 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.10.0-D7QN/s1851455922661?AQB=1&ndh=1&pf=1&t=6%2F4%2F2019%2015%3A4%3A13%201%200&sdid=50613051A1DF05D6-126C4B14E3A328EC&D=D%3D&mid=22241934778104813593193714239135049564&aamlh=6&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Amicrosoft-windows-office-zeroday-remote-code-vulnerabilities&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&events=event3&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&v3=%2B1&c7=Entire%20Site&c8=New&v25=22241934778104813593193714239135049564&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Amicrosoft-windows-office-zeroday-remote-code-vulnerabilities&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:13 GMT
X-Content-Type-Options
nosniff
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 15:04:13 GMT
Server
Omniture DC/2.0.0
xserver
www208
ETag
"3343965013805170688-6540248246978097026"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Sun, 05 May 2019 15:04:13 GMT
json
fortinet.tt.omtrdc.net/m2/fortinet/mbox/ 		97 B
358 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fortinet.tt.omtrdc.net/m2/fortinet/mbox/json?mbox=target-global-mbox&mboxSession=0de7a67f1ddf412da902de85e07eba45&mboxPC=&mboxPage=9cfadfaa0d1b4be4b8eb2e972e487ef4&mboxRid=6e8de558d8b749f989807ebcd9943cd3&mboxVersion=1.6.4&mboxCount=1&mboxTime=1557155051691&mboxHost=www.fortinet.com&mboxURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=0&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&mboxMCSDID=50613051A1DF05D6-126C4B14E3A328EC&vst.trk=nsmetrics.fortinet.com&vst.trks=metrics.fortinet.com&mboxMCGVID=22241934778104813593193714239135049564&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCGLH=6
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
66.117.29.6 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
/
Resource Hash
e0b1995f77d7166627dbdce822e23b82d2338c7c960063f713acbb464d8e44b6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Origin
https://www.fortinet.com

Response headers

pragma
no-cache
date
Mon, 06 May 2019 15:04:12 GMT
status
200
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache
access-control-allow-credentials
true
timing-allow-origin
*
content-length
97
x-request-id
6e8de558d8b749f989807ebcd9943cd3
7OBVBCAQE5FHDPFEAD5T4D
d.adroll.com/consent/check/ 		40 B
200 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D?_s=58fb5e7910eb6e7611feff7c3ff402d9
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.51.181.97 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-46-51-181-97.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
6f43e1e85c42d5e449308701054501d9867a7254c9a8734406afbc89b3dfe5b4

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:14 GMT
Server
nginx/1.14.1
Connection
keep-alive
Content-Length
40
Content-Type
application/javascript
/
graph.facebook.com/ 		647 B
815 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&callback=window.__sharethis__.cb4
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:20e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
17de7df105a6aee5b702f03dc2dc40ccea6f6566aa5da9667b1214dc6516c170
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
date
Mon, 06 May 2019 15:04:13 GMT
x-fb-rev
1000675738
content-length
370
pragma
no-cache
x-fb-debug
fCJKJbBQ60PfoV2ih2LjGs+1rN5cD9XzFpgrEvgyjjPbW5oDBIe2ayB36pU/7ekazWkcq1no0K1FFVZAtAus5A==
x-fb-trace-id
BjZFzZf/e+0
etag
"ef898c651ec1b0a26e007acaa472d9ef2b00732e"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
At4EVgXTvYmlz0_1vUJ_R91
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.9
expires
Sat, 01 Jan 2000 00:00:00 GMT
consent.js
s.adroll.com/j/ 		67 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/consent.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.206 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-206.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
4983cd18419e417077dcc013922828394049ce6c65db6a782d2d73f225d46089

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
yvF3y5OARyGYjZyuW4BqgiCbPvLhhPrH
Content-Encoding
gzip
x-amz-request-id
7EBD99F69567301D
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 06 May 2019 15:04:14 GMT
Connection
keep-alive
Content-Length
15051
x-amz-id-2
ZAMLcakp6pamVvhjTbjoBOeKm/lFBqsh3HyHLH8XDul6YO1D/T5bOMFfxhZ5XZIR3NTSb8PhK6U=
Last-Modified
Thu, 06 Dec 2018 16:37:43 GMT
Server
AmazonS3
ETag
"53cd26585ff224c6851303016ec98536"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
hod
d.adroll.com/consent/ 		42 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/consent/hod?_e=view_banner&_s=58fb5e7910eb6e7611feff7c3ff402d9&_b=626d9f6089ce68&_a=7OBVBCAQE5FHDPFEAD5T4D
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.246.124.93 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-246-124-93.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 15:04:14 GMT
Cache-Control
no-transform,public,max-age=300,s-maxage=900
Server
nginx/1.14.1
Connection
keep-alive
Content-Length
42
Vary
Cookie
Content-Type
image/gif
/
px.ads.linkedin.com/collect/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?time=1557155054465&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&fmt=...
  • https://px.ads.linkedin.com/collect/?time=1557155054465&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&fmt=...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557155054465%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-rese...
  • https://px.ads.linkedin.com/collect/?time=1557155054465&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&fmt=...
0
103 B 		Script
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/collect/?time=1557155054465&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&fmt=js&s=1&cookiesTest=true&liSync=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:119:50e2:105::6cae:b35 , United States, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/microsoft-windows-office-zeroday-remote-code-vulnerabilities.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 15:04:15 GMT
content-encoding
gzip
server
Play
vary
Accept-Encoding
x-li-fabric
prod-lor1
status
200
x-li-proto
http/2
x-li-pop
prod-ela1
content-type
application/javascript
content-length
20
x-li-uuid
nOyOwkUgnBVAdhkQ9SoAAA==

Redirect headers

date
Mon, 06 May 2019 15:04:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
302
x-li-pop
prod-tln1
content-length
20
x-li-uuid
CcWXZEYgnBUggMsioisAAA==
pragma
no-cache
server
Play
x-frame-options
sameorigin
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
vary
Accept-Encoding
strict-transport-security
max-age=2592000
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect/?time=1557155054465&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmicrosoft-windows-office-zeroday-remote-code-vulnerabilities.html&fmt=js&s=1&cookiesTest=true&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

138 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| dataLayer function| e function| Visitor object| _satellite object| s_c_il number| s_c_in function| targetPageParams object| adobe object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate function| postscribe object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| csCookies object| cookieScriptWindow object| cookieScripts string| cookieScriptSrc function| cookieQuery string| cookieScriptPosition string| cookieScriptSource string| cookieScriptDomain string| cookieScriptReadMore string| cookieId number| cookieScriptDebug boolean| cookieScriptShowBadge string| cookieScriptCurrentUrl string| pagePath string| cookieScriptTitle string| cookieScriptDesc string| cookieScriptAccept string| cookieScriptMore string| cookieScriptCopyrights string| cookieBackground function| setImmediate function| clearImmediate function| $ function| jQuery undefined| Cookies string| cookieScriptReject function| cookieScriptLoadJavaScript function| InjectCookieScript string| cookieScriptStatsDomain function| cookieScriptCreateCookie function| cookieScriptReadCookie function| cookieScriptAddBox object| cookieScriptCurrentValue string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded string| _bizo_data_partner_id undefined| _bizo_data_partner_title undefined| _bizo_data_partner_domain undefined| _bizo_data_partner_company undefined| _bizo_data_partner_location undefined| _bizo_data_partner_employee_range undefined| _bizo_data_partner_sics undefined| _bizo_data_partner_email function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq object| t function| OptinMonsterApp boolean| om_loaded object| om45602_39852 object| _omapp object| omajiy6yksgfbr0illbjel object| ombs6hw8oho0l8z5lmhzmv object| omqxx1b0gslklfu2kjckea object| omtaoi2gud8wo2ip9kbnpv function| fbAsyncInit object| s_i_fortinetincproduction string| adroll_sid object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks function| adroll_tpc_callback object| __adroll_consent boolean| __adroll_consent_is_gdpr object| $jscomp string| BANNER_VERSION object| __adroll_consent_banner function| _bizo_local_logger function| _bizo_fire_partners boolean| _bizo_main_already_called

0 Cookies

9 Console Messages

Source Level URL
Text
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[object Object]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
console.groupEnd
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[object Object]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
console.groupEnd

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mstrlytcs.com
a.optmnstr.com
api.opmnstr.com
assets.adobedtm.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
cm.everesttech.net
count-server.sharethis.com
d.adroll.com
dpm.demdex.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
fortinetinc.sc.omtrdc.net
graph.facebook.com
l.sharethis.com
metrics.fortinet.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
s.adroll.com
sjs.bizographics.com
www.fortinet.com
www.google-analytics.com
www.googletagmanager.com
www.linkedin.com
z.opmnstr.com
104.111.214.206
104.111.217.111
165.227.67.158
172.82.228.19
172.82.235.45
178.128.135.232
18.184.119.244
2.16.186.243
2.19.43.118
23.111.9.217
2620:119:50e2:105::6cae:b35
2a00:1450:4001:81f::200e
2a00:1450:4001:824::2008
2a02:26f0:f1:28a::3adf
2a03:2880:f01c:20e:face:b00c:0:2
2a05:f500:11:101::b93f:9001
34.203.158.69
46.51.181.97
50.17.52.222
52.211.104.45
52.213.106.142
52.52.145.59
52.8.142.247
54.246.124.93
54.72.80.76
66.117.28.86
66.117.29.6
04c7fc62027de4c79f20a877f16b3fe9ecc2c45c647cb632b92f0d442784991c
17853c0cd1ce0a2b1a11885854920b9d1e7899bcb98bef49930ba54c069ba354
17de7df105a6aee5b702f03dc2dc40ccea6f6566aa5da9667b1214dc6516c170
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
24038492cb3d19fef34ce0a9bc55033f3030c04eeea97a93c22b2ec8914c1316
2d95e9cd3ff86f203b97db941503341afcf1edb03fde6ad8da1e8fe8c662bedd
3bef5c13ae0f633b1f8ae82eff69129499299192d57382d109f447daa5888bbf
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
41cd14971fd10dbeb7ddacf6c792a2f40fb62cfbb36a725a1cb02dfb9c165206
4983cd18419e417077dcc013922828394049ce6c65db6a782d2d73f225d46089
57eb0a277e2d3a3261a0252bafaca6eb8d6d8cc2ca4e0ef625a6eff980af31a9
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
604ae5068c06ac47597ed7e1c587a0ce7d8ff6e8174a979b285169f1b3277016
624fb66a132f5828e22be5efae5cf887bee492c4d89d910d40c936e2f5ed2fb9
68588db4f09f1982d74887644c54e581cc6ed7e267f836a480c29ef1a3c0a7a0
696bac8666ce5bf4e390c7f71dc783a17fb56a3b429c6ff35dd5ad52ae254988
6d73aa32774fb131ebbc1faf3f931aaf66e998f808757cbafbcc737f8d769580
6f43e1e85c42d5e449308701054501d9867a7254c9a8734406afbc89b3dfe5b4
7f0daa7591ef2b42b26dd9d39102440c242e7fd798e7898a620e5489d67ec73e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85c6103aabd94bf4584fbdd8b15cb68c08fa52f43dc229ac034a1bf6c855c0bc
94e12db37d01c4b0f8029d72f97d681aeb51fe066c95dde62c84ac3b133dbadf
a0b376a73b48e8b75e96ca3f5ac6521a3687cd5fdee7963d63793f8d6dd7616f
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
bf37dba5836581c0cc0451edd5c197e46a5a0e070b3f696e5b4bf7e32da1817a
c001e01a6b6a23f4619521bb9a5cdea66124971ab04cf0211649015b0c4af1b1
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
dbeeb3fa5f0188835b6b6208bc89d641f030e79e27ad5712d427eabd79e6095a
e0b1995f77d7166627dbdce822e23b82d2338c7c960063f713acbb464d8e44b6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040
eb6058ea8eec777d07e89407b55de7990eb296b3f5a5ee4a6b04c71d3c129c42
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2bf5964adbfac80827ae87c5f7c0f05e51f416e3e2132fd93dc2e2d98f2e935
f9653b3215f496b0d1e36068d49cdaab0a66b305055197147e4e73d226ee162e