www.horizon3.ai Open in urlscan Pro
104.197.16.226  Public Scan

21 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 45

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1677254837050&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3527860%26time%3D1677254837050%26url%3Dhttps%253A%252F%252Fwww.horizon3.ai%252Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1677254837050&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1677254837050&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&liSync=true&e_ipv6=AQIPQL1z4b_xkwAAAYaELcSP-PmBXphgSflc4v6zPSI9hX8KSKM4W8aeIXP6HI9Ucb86t7rvSm_MVg

67 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
12 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/	281 KB 48 KB	812ms 181ms	Document text/html	104.197.16.226 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.197.16.226 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 226.16.197.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 3a0204445ce751a6a732fc1ed6fe74998cc675f0c70f5eab939ddf54a64d2478 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection "1; mode=block" Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=600, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Fri, 24 Feb 2023 16:07:15 GMT last-modified Wed, 22 Feb 2023 15:06:21 GMT link <https://www.horizon3.ai/wp-json/>; rel="https://api.w.org/" <https://www.horizon3.ai/wp-json/wp/v2/posts/5420>; rel="alternate"; type="application/json" <https://www.horizon3.ai/?p=5420>; rel=shortlink permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=() referrer-policy no-referrer-when-downgrade server nginx strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie x-cache HIT: 17 x-cache-group normal x-cacheable SHORT x-content-type-options nosniff x-frame-options SAMEORIGIN x-pingback https://www.horizon3.ai/xmlrpc.php x-powered-by WP Engine x-xss-protection "1; mode=block"
GET H2	200	165b94b5b87e26a4e118a794f03eacf8.css u6z4d6v3.rocketcdn.me/wp-content/cache/min/1/	164 KB 26 KB	56ms 10ms	Stylesheet text/css	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://u6z4d6v3.rocketcdn.me/wp-content/cache/min/1/165b94b5b87e26a4e118a794f03eacf8.css Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash d94a13b0b189480b349309376326a8ca94958eeaf5618e0f23df3687af5642e1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection "1; mode=block" Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-powered-by RocketCDN content-length 25725 x-xss-protection "1; mode=block" referrer-policy no-referrer-when-downgrade last-modified Tue, 31 Jan 2023 22:06:25 GMT server nginx etag W/"63d990e1-29188" x-frame-options SAMEORIGIN x-hw 1677254836.cds101.fr8.hn,1677254836.cds158.fr8.c content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=() vary Accept-Encoding accept-ranges bytes link <https://horizon3.ai/wp-content/cache/min/1/165b94b5b87e26a4e118a794f03eacf8.css>; rel="canonical"
GET H2	200	jquery.min.js Show response u6z4d6v3.rocketcdn.me/wp-includes/js/jquery/	88 KB 31 KB	12ms 12ms	Script application/javascript	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://u6z4d6v3.rocketcdn.me/wp-includes/js/jquery/jquery.min.js?ver=3.6.1 Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT content-encoding gzip last-modified Mon, 19 Sep 2022 14:16:24 GMT server nginx etag W/"632879b8-15e54" x-powered-by RocketCDN vary Accept-Encoding x-hw 1677254836.cds101.fr8.hn,1677254836.cds341.fr8.c content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes link <https://horizon3.ai/wp-includes/js/jquery/jquery.min.js>; rel="canonical" content-length 31228
GET H2	200	gtm.js Show response www.googletagmanager.com/	209 KB 75 KB	74ms 39ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 3df7db4a6691ed2a879005ad13c0984c4fcf7cd6ad1bea464caa7719654eb69f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 76432 x-xss-protection 0 last-modified Fri, 24 Feb 2023 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 24 Feb 2023 16:07:16 GMT
GET H2	200	Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png.webp u6z4d6v3.rocketcdn.me/wp-content/uploads/2022/06/	13 KB 13 KB	11ms 11ms	Image image/webp	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Show image Full URL https://u6z4d6v3.rocketcdn.me/wp-content/uploads/2022/06/Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png.webp Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash 70631b3ab478a15e8a26f17b8bb991464916725030d772237692c217e0d21334 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT last-modified Wed, 03 Aug 2022 00:00:29 GMT server nginx etag "62e9ba9d-3214" x-powered-by RocketCDN vary Accept-Encoding x-hw 1677254836.cds101.fr8.hn,1677254836.cds330.fr8.c content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes link <https://horizon3.ai/wp-content/uploads/2022/06/Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png.webp>; rel="canonical" content-length 12820
GET H2	200	iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUU1.woff2 fonts.gstatic.com/s/rubik/v23/	23 KB 23 KB	74ms 14ms	Font font/woff2	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/rubik/v23/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUU1.woff2 Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2b55dedda5358c3b35f17d21ab2f636b4b5221c347b8d2dba2c51d64fa55bd79 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.horizon3.ai/ Origin https://www.horizon3.ai accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 09:04:13 GMT x-content-type-options nosniff age 111783 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 23168 x-xss-protection 0 last-modified Wed, 07 Dec 2022 18:07:55 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 23 Feb 2024 09:04:13 GMT
GET H2	200	modules.ttf u6z4d6v3.rocketcdn.me/wp-content/themes/Divi/core/admin/fonts/modules/all/	90 KB 91 KB	57ms 37ms	Font application/octet-stream	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://u6z4d6v3.rocketcdn.me/wp-content/themes/Divi/core/admin/fonts/modules/all/modules.ttf Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09 Request headers Referer https://www.horizon3.ai/ Origin https://www.horizon3.ai accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT last-modified Thu, 27 Oct 2022 21:55:37 GMT server nginx etag "635afe59-168f0" x-powered-by RocketCDN vary Accept-Encoding x-hw 1677254836.cds250.fr8.hn,1677254836.cds001.fr8.c content-type application/octet-stream access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes link <https://horizon3.ai/wp-content/themes/Divi/core/admin/fonts/modules/all/modules.ttf>; rel="canonical" content-length 92400
GET H2	200	iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-2Y-FWUU1.woff2 fonts.gstatic.com/s/rubik/v23/	23 KB 23 KB	90ms 32ms	Font font/woff2	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/rubik/v23/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-2Y-FWUU1.woff2 Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eebc46510701056c3839d5700f701fc4c8768fc1a2669ac2ed8c33a8d7be250c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.horizon3.ai/ Origin https://www.horizon3.ai accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Sun, 19 Feb 2023 02:15:13 GMT x-content-type-options nosniff age 481923 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 23172 x-xss-protection 0 last-modified Wed, 07 Dec 2022 18:07:53 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Mon, 19 Feb 2024 02:15:13 GMT
GET H2	200	iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUU1.woff2 fonts.gstatic.com/s/rubik/v23/	23 KB 23 KB	93ms 38ms	Font font/woff2	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/rubik/v23/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUU1.woff2 Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0226315ec0de04c8ea5c94525287c230fc7a6dbb000f2f1b5288a40558e92e16 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.horizon3.ai/ Origin https://www.horizon3.ai accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 22:42:47 GMT x-content-type-options nosniff age 62669 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 23224 x-xss-protection 0 last-modified Wed, 07 Dec 2022 18:13:08 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 23 Feb 2024 22:42:47 GMT
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6faaa42846429ef1863c71b66fb058e3a4ef4f2fdaec066a384e0344f2c9a5da Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	67 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 07ef830fe30a69889633c3c9257e2178361572116f496389c30b2ef6005da5f0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	67 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 924d8891643e40ddd7d869600305f81874cb06c2ca34cad2d09e3ab86aba84c4 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 859ed59cc5269fbd29dff61f5a19078c8c19a57707a347f1273de606b17c3c39 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 16e5eb15345c77251b4e0f6b60dc9f1df8472c860331e962e562989da041a7f2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash be3af8cfc915ae21f2cbb11a73b571059a1767cdf5cacf8f7897c36474a6224a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7b3793028ec687f671d0fd82a04de0b688e4b4081a7d31c13dc6490d75404193 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b1ac21eece89eddbe51f985f8ea741341e91878c99c5c3029b33a7480ef71dfc Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	67 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 047347a84de6f7255239ea37891645936bce8a0801f8cdee9df11c608dbc47bd Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	66 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8453e1519330acc3672c4e36d794345c5d73694c9c6f697697160ef06a6c46a5 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUU1.woff2 fonts.gstatic.com/s/rubik/v23/	22 KB 22 KB	25ms 25ms	Font font/woff2	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/rubik/v23/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUU1.woff2 Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6585d2e8b3170e6e3d0316cbfc4766af1c33eddb39c2b334851ed7b99fd9eb77 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.horizon3.ai/ Origin https://www.horizon3.ai accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 10:49:37 GMT x-content-type-options nosniff age 19059 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 22860 x-xss-protection 0 last-modified Wed, 07 Dec 2022 18:13:10 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 24 Feb 2024 10:49:37 GMT
GET DATA	200 OK	truncated /	67 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1a6573f3119e669f076691dace74b1c2587a7904c59c90bdd186c4587ead4ff0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	js Show response boards.greenhouse.io/embed/job_board/	5 KB 2 KB	904ms 121ms	Script text/html	54.243.78.41 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://boards.greenhouse.io/embed/job_board/js?for=horizon3 Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 54.243.78.41 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-243-78-41.compute-1.amazonaws.com Software / Resource Hash 141ff8c7aafbacc156f54a9e1364cd767c8d7e58c0009a9abf4e3c146e1c1517 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-runtime 0.007514 date Fri, 24 Feb 2023 16:07:17 GMT strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip etag W/"141ff8c7aafbacc156f54a9e1364cd76" x-download-options noopen vary Accept-Encoding content-type text/html; charset=utf-8 cache-control max-age=0, private, must-revalidate x-xss-protection 1; mode=block x-request-id 1bc9225ef438bd32d0ba192543bb4b2e
GET H2	200	lazyload.min.js Show response u6z4d6v3.rocketcdn.me/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/	8 KB 3 KB	11ms 11ms	Script application/javascript	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://u6z4d6v3.rocketcdn.me/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash 8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT content-encoding gzip last-modified Thu, 27 Oct 2022 21:52:49 GMT server nginx etag W/"635afdb1-2063" x-powered-by RocketCDN vary Accept-Encoding x-hw 1677254836.cds101.fr8.hn,1677254836.cds320.fr8.c content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes link <https://horizon3.ai/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js>; rel="canonical" content-length 2890
GET H2	200	52ee53b339846f2bf3dc763e7d9afa19.js Show response u6z4d6v3.rocketcdn.me/wp-content/cache/min/1/	358 KB 98 KB	14ms 14ms	Script application/javascript	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://u6z4d6v3.rocketcdn.me/wp-content/cache/min/1/52ee53b339846f2bf3dc763e7d9afa19.js Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash 0f670e8a86f9254f0a67b74de077e05cfa1a5fedde5f1991321f167901db23f4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection "1; mode=block" Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload x-powered-by RocketCDN content-length 100338 x-xss-protection "1; mode=block" referrer-policy no-referrer-when-downgrade last-modified Tue, 31 Jan 2023 22:06:26 GMT server nginx etag W/"63d990e2-5981f" x-frame-options SAMEORIGIN x-hw 1677254836.cds101.fr8.hn,1677254836.cds160.fr8.c content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=() vary Accept-Encoding accept-ranges bytes link <https://horizon3.ai/wp-content/cache/min/1/52ee53b339846f2bf3dc763e7d9afa19.js>; rel="canonical"
GET H2	200	Red-Team-Blog-BG.jpg u6z4d6v3.rocketcdn.me/wp-content/uploads/2022/10/	51 KB 52 KB	14ms 13ms	Image image/jpeg	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Show image Full URL https://u6z4d6v3.rocketcdn.me/wp-content/uploads/2022/10/Red-Team-Blog-BG.jpg Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash 6555189a58cede3f19c2269dfa21e1e86734f122f0e190bfaaee35895dcbd9fe Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT last-modified Fri, 14 Oct 2022 18:21:09 GMT server nginx etag "6349a895-cdcc" x-powered-by RocketCDN vary Accept-Encoding x-hw 1677254836.cds101.fr8.hn,1677254836.cds321.fr8.c content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes link <https://horizon3.ai/wp-content/uploads/2022/10/Red-Team-Blog-BG.jpg>; rel="canonical" content-length 52684
GET H2	200	S6uyw4BMUTPHjxAwXg.woff2 fonts.gstatic.com/s/lato/v23/	25 KB 25 KB	22ms 21ms	Font font/woff2	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjxAwXg.woff2 Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 386a206aade080bb0045005cfdbb660430ed46d652039eef6bc299d54d7c43ed Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.horizon3.ai/ Origin https://www.horizon3.ai accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Tue, 21 Feb 2023 08:00:05 GMT x-content-type-options nosniff age 288431 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 25284 x-xss-protection 0 last-modified Tue, 26 Apr 2022 15:46:28 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 21 Feb 2024 08:00:05 GMT
GET H2	200	iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUUz.woff fonts.gstatic.com/s/rubik/v23/	29 KB 29 KB	14ms 14ms	Font font/woff	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/rubik/v23/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUUz.woff Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 868388bcff16afe95b3d8f4c14db485aeefea4cd26e5bbf7c79e815ee2d99d2a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.horizon3.ai/ Origin https://www.horizon3.ai accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Wed, 22 Feb 2023 09:03:48 GMT x-content-type-options nosniff age 198208 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 29880 x-xss-protection 0 last-modified Wed, 07 Dec 2022 18:07:53 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 22 Feb 2024 09:03:48 GMT
GET H3	200	iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUUw.ttf fonts.gstatic.com/s/rubik/v23/	62 KB 32 KB	18ms 18ms	Font font/ttf	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/rubik/v23/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUUw.ttf Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3444576734efd467b43daf6fe61d94820738b50475c83ecdcebf42497ed687c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.horizon3.ai/ Origin https://www.horizon3.ai accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 06:27:05 GMT content-encoding gzip x-content-type-options nosniff age 34811 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33074 x-xss-protection 0 last-modified Wed, 07 Dec 2022 18:07:54 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" vary Accept-Encoding report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/ttf access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 24 Feb 2024 06:27:05 GMT
GET H2	200	optimize.js Show response www.googleoptimize.com/	119 KB 46 KB	696ms 62ms	Script application/javascript	2a00:1450:400d:806::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleoptimize.com/optimize.js?id=OPT-M6CGZHN Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash ea2b4e06adb96b22562915be7e24436416adabfafaff95c4fa8b5ac6c25c0e8d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:17 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 46810 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Fri, 24 Feb 2023 16:07:17 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10792903506/	2 KB 1 KB	716ms 87ms	Script text/javascript	2a00:1450:400d:802::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10792903506/?random=1677254836409&cv=11&fst=1677254836409&bg=ffffff&guid=ON&async=1&gtm=45He32m0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&tiba=Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai&auid=128272095.1677254836&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:802::2002 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 56c863cae19cce8085c2a4c2522260f676c7df2487d009ee89b08765db329e86 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:17 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 934 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	23 KB 8 KB	625ms 7ms	Script application/javascript	2a04:4e42:600::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:17 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish last-modified Mon, 23 Jan 2023 21:56:14 GMT server snooserv nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} etag "03d5db9dfd00a5719bb4c9261e6fa1bb" vary Accept-Encoding,Origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]} content-type application/javascript cache-control public, max-age=60 accept-ranges bytes content-length 7356
GET H/1.1	200 OK	pd.js Show response pi.pardot.com/	5 KB 2 KB	728ms 104ms	Script application/javascript	34.237.219.119 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pi.pardot.com/pd.js Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 34.237.219.119 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-237-219-119.compute-1.amazonaws.com Software PardotServer / Resource Hash 3b91e6a4b14493d67f9660e6d4a2e27c1eea54d97ccb7c30acf3b89998b3be99 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Fri, 24 Feb 2023 16:07:17 GMT content-encoding gzip X-Pardot-Route 16b0ab393667a33fe86adedc3141e88c last-modified Fri, 24 Feb 2023 05:29:00 GMT Server PardotServer etag "1547-gzip" vary Accept-Encoding,User-Agent Content-Type application/javascript cache-control max-age=63072000 Connection keep-alive accept-ranges bytes Content-Length 1946 expires Sun, 23 Feb 2025 16:07:17 GMT
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	13 KB 5 KB	628ms 11ms	Script application/x-javascript	2a02:26f0:3500:16::215:149b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:17 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 10 Jan 2023 17:22:56 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=58269 accept-ranges bytes content-length 4777
GET H/1.1	200 OK	PLwGhTJP Show response io.clickguard.com/s/cHJvdGVjdG9y/	8 KB 3 KB	745ms 131ms	Script application/javascript	2606:4700:20::681a:d98 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://io.clickguard.com/s/cHJvdGVjdG9y/PLwGhTJP Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:d98 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 8ff7767c35068f1810490177f6cd1955b25bcf8af2d3342eb7ce81a8d3f9469f Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Fri, 24 Feb 2023 16:07:17 GMT via 1.1 google Content-Encoding br CF-Cache-Status DYNAMIC NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare x-powered-by Express etag W/"1ed3-WFEoquoWhC65TopnXy4K7fVSbTc" Transfer-Encoding chunked Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8gWtwwI9QBbTtJbK74SxWfskue4NXPlrJb2LRsB6YzrUgJFXAaNnjpIyy%2F6MbtcaeX7fH9AKZnJ5H7lDeu44lcU2gRt%2FB85J6SL07a8VbDm73%2F%2BJSGQALNtxAnYOnrzJxSzyAL3S1kSbxbCMcnn2"}],"group":"cf-nel","max_age":604800} Content-Type application/javascript; charset=utf-8 access-control-allow-origin * Connection keep-alive CF-RAY 79e9740b791a9202-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept
GET H2	200	js Show response www.googletagmanager.com/gtag/	252 KB 82 KB	36ms 36ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-V462VSRXXS&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d97e71e4167996b082f0ba69f88d252e42b45f49304f3d6187bb82a82f03f5b9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 83351 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Fri, 24 Feb 2023 16:07:16 GMT
GET H2	200	1200x627-Red-Team-Fortinet-CVE-2022-39952.jpg.webp u6z4d6v3.rocketcdn.me/wp-content/uploads/2023/02/	27 KB 27 KB	17ms 16ms	Image image/webp	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Show image Full URL https://u6z4d6v3.rocketcdn.me/wp-content/uploads/2023/02/1200x627-Red-Team-Fortinet-CVE-2022-39952.jpg.webp Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash e1141ff527b06f12d3fc9fa30b650c0081310e24d04a4fabc4b39c8dad6116e6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection "1; mode=block" Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-powered-by RocketCDN content-length 27354 x-xss-protection "1; mode=block" referrer-policy no-referrer-when-downgrade last-modified Mon, 20 Feb 2023 14:54:58 GMT server nginx etag "63f389c2-6ada" x-frame-options SAMEORIGIN x-hw 1677254836.cds101.fr8.hn,1677254836.cds221.fr8.c content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=() vary Accept-Encoding accept-ranges bytes link <https://horizon3.ai/wp-content/uploads/2023/02/1200x627-Red-Team-Fortinet-CVE-2022-39952.jpg.webp>; rel="canonical"
GET H2	200	Screen-Shot-2023-02-20-at-8.38.22-AM.png.webp u6z4d6v3.rocketcdn.me/wp-content/uploads/2023/02/	9 KB 9 KB	23ms 22ms	Image image/webp	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Show image Full URL https://u6z4d6v3.rocketcdn.me/wp-content/uploads/2023/02/Screen-Shot-2023-02-20-at-8.38.22-AM.png.webp Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash a2b3e9aaf6eff3e4831f460b2223349c30b86b6a50f4317517332fbcb90c6ac9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection "1; mode=block" Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-powered-by RocketCDN content-length 8798 x-xss-protection "1; mode=block" referrer-policy no-referrer-when-downgrade last-modified Mon, 20 Feb 2023 13:41:05 GMT server nginx etag "63f37871-225e" x-frame-options SAMEORIGIN x-hw 1677254836.cds101.fr8.hn,1677254836.cds239.fr8.c content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=() vary Accept-Encoding accept-ranges bytes link <https://horizon3.ai/wp-content/uploads/2023/02/Screen-Shot-2023-02-20-at-8.38.22-AM.png.webp>; rel="canonical"
GET H2	200	Screen-Shot-2023-02-20-at-8.39.32-AM.png.webp u6z4d6v3.rocketcdn.me/wp-content/uploads/2023/02/	8 KB 8 KB	23ms 23ms	Image image/webp	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Show image Full URL https://u6z4d6v3.rocketcdn.me/wp-content/uploads/2023/02/Screen-Shot-2023-02-20-at-8.39.32-AM.png.webp Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash ef6fcac0ed2e98f9771424c2387f70ed85d140acad913cb626bc96b9216be0c0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection "1; mode=block" Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-powered-by RocketCDN content-length 8068 x-xss-protection "1; mode=block" referrer-policy no-referrer-when-downgrade last-modified Mon, 20 Feb 2023 13:49:19 GMT server nginx etag "63f37a5f-1f84" x-frame-options SAMEORIGIN x-hw 1677254836.cds101.fr8.hn,1677254836.cds339.fr8.c content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=() vary Accept-Encoding accept-ranges bytes link <https://horizon3.ai/wp-content/uploads/2023/02/Screen-Shot-2023-02-20-at-8.39.32-AM.png.webp>; rel="canonical"
GET H2	200	meld.png.webp u6z4d6v3.rocketcdn.me/wp-content/uploads/2023/02/	50 KB 50 KB	24ms 24ms	Image image/webp	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Show image Full URL https://u6z4d6v3.rocketcdn.me/wp-content/uploads/2023/02/meld.png.webp Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash 5d369d308e1b3e8e3bdc26fd6f59517dfa3c66d15491e83ec6681e855a20c991 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection "1; mode=block" Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-powered-by RocketCDN content-length 51142 x-xss-protection "1; mode=block" referrer-policy no-referrer-when-downgrade last-modified Mon, 20 Feb 2023 13:32:05 GMT server nginx etag "63f37655-c7c6" x-frame-options SAMEORIGIN x-hw 1677254836.cds101.fr8.hn,1677254836.cds167.fr8.c content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=() vary Accept-Encoding accept-ranges bytes link <https://horizon3.ai/wp-content/uploads/2023/02/meld.png.webp>; rel="canonical"
GET H2	200	Screen-Shot-2023-02-18-at-12.53.40-PM.png.webp u6z4d6v3.rocketcdn.me/wp-content/uploads/2023/02/	153 KB 153 KB	26ms 26ms	Image image/webp	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Show image Full URL https://u6z4d6v3.rocketcdn.me/wp-content/uploads/2023/02/Screen-Shot-2023-02-18-at-12.53.40-PM.png.webp Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash 861fa6a4cf055588f061bd34921ca3a27c003abb0a72398591deef92b7753ada Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection "1; mode=block" Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-powered-by RocketCDN content-length 156484 x-xss-protection "1; mode=block" referrer-policy no-referrer-when-downgrade last-modified Mon, 20 Feb 2023 13:34:57 GMT server nginx etag "63f37701-26344" x-frame-options SAMEORIGIN x-hw 1677254836.cds101.fr8.hn,1677254836.cds228.fr8.c content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=() vary Accept-Encoding accept-ranges bytes link <https://horizon3.ai/wp-content/uploads/2023/02/Screen-Shot-2023-02-18-at-12.53.40-PM.png.webp>; rel="canonical"
POST H2	204	collect region1.analytics.google.com/g/	0 245 B	512ms 21ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-V462VSRXXS&gtm=45je32m0&_p=726748394&_gaz=1&cid=651226317.1677254837&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1677254836&sct=1&seg=0&dl=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&dt=Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-V462VSRXXS&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:17 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.horizon3.ai cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 245 B	511ms 21ms	Ping text/plain	2a00:1450:4025:402::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-V462VSRXXS&cid=651226317.1677254837&gtm=45je32m0&aip=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-V462VSRXXS&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4025:402::9d Den Helder, Netherlands, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:17 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.horizon3.ai cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 408 B	530ms 41ms	Image image/gif	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-V462VSRXXS&cid=651226317.1677254837&gtm=45je32m0&aip=1&z=1056965989 Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:17 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	rp.gif alb.reddit.com/	42 B 157 B	142ms 109ms	Image image/gif	151.101.1.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1677254837047&id=t2_rwb6eefi&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&uuid=efb65acb-5463-4653-b9e5-92cfaf877abc&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_65e23bc4 Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:17 GMT via 1.1 varnish server Varnish content-type image/gif cross-origin-resource-policy cross-origin accept-ranges bytes content-length 42 retry-after 0
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/3527860/domain/horizon3.ai/	36 B 377 B	74ms 13ms	XHR application/json	2600:9000:225e:e200:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/3527860/domain/horizon3.ai/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:e200:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 15:12:23 GMT content-encoding gzip via 1.1 307395f1eb3989f15e6f525475291c86.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 age 3294 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id rZl7BC9iPNyJ6ysSW-tAJ6Ouom60qMBNZ-wEH5LD6gZX-LwdTJVMVA==
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1677254837050&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3527860%26time%3D1677254837050%26url%3Dhttps%253A%252F%252Fwww.horizon3.ai%252Ffo... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1677254837050&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1677254837050&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&liSync=true&e_ipv6=AQIPQL1z...	0 265 B	150ms 105ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1677254837050&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&liSync=true&e_ipv6=AQIPQL1z4b_xkwAAAYaELcSP-PmBXphgSflc4v6zPSI9hX8KSKM4W8aeIXP6HI9Ucb86t7rvSm_MVg Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:17 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 64D86469B4F94F9484C23351717A444D Ref B: FRAEDGE1420 Ref C: 2023-02-24T16:07:17Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lva1 x-li-proto http/2 content-length 0 x-li-uuid AAX1dFLKCJhD1cV2WwMyAA== Redirect headers date Fri, 24 Feb 2023 16:07:16 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 21C11498FDA34747B3CC3D7680F948E8 Ref B: FRAEDGE1213 Ref C: 2023-02-24T16:07:17Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lva1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1677254837050&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&liSync=true&e_ipv6=AQIPQL1z4b_xkwAAAYaELcSP-PmBXphgSflc4v6zPSI9hX8KSKM4W8aeIXP6HI9Ucb86t7rvSm_MVg x-li-proto http/2 content-length 0 x-li-uuid AAX1dFLHs0mSYQhBAytnXQ==
GET H2	200	/ www.google.com/pagead/1p-user-list/10792903506/	42 B 455 B	66ms 29ms	Image image/gif	2a00:1450:4001:802::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10792903506/?random=1677254836409&cv=11&fst=1677254400000&bg=ffffff&guid=ON&async=1&gtm=45He32m0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&tiba=Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai&fmt=3&is_vtc=1&random=3739374185&rmt_tld=0&ipr=y Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:17 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10792903506/	42 B 154 B	26ms 26ms	Image image/gif	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10792903506/?random=1677254836409&cv=11&fst=1677254400000&bg=ffffff&guid=ON&async=1&gtm=45He32m0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&tiba=Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai&fmt=3&is_vtc=1&random=3739374185&rmt_tld=1&ipr=y Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:17 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	analytics Show response pi.pardot.com/	1 KB 2 KB	266ms 266ms	Script text/javascript	34.237.219.119 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=17120&account_id=972073&title=Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&referrer= Requested by Host: pi.pardot.com URL: https://pi.pardot.com/pd.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 34.237.219.119 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-237-219-119.compute-1.amazonaws.com Software PardotServer / Resource Hash 801b1b69a21e7abeb7dc7636f487aeb25979509a20590db68df8fed5382ae5a9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache Date Fri, 24 Feb 2023 16:07:17 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip X-Pardot-Route 9b06e8e2308c32c7bf9ba8adfb7be2e1 x-pardot-rsp 0/0/1 Server PardotServer vary Accept-Encoding,User-Agent Content-Type text/javascript; charset=utf-8 p3p CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml" cache-control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 534 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	tag.aspx Show response ml314.com/	31 KB 11 KB	87ms 15ms	Script application/javascript	34.111.234.236 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://ml314.com/tag.aspx?241 Requested by Host: u6z4d6v3.rocketcdn.me URL: https://u6z4d6v3.rocketcdn.me/wp-content/cache/min/1/52ee53b339846f2bf3dc763e7d9afa19.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.111.234.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 236.234.111.34.bc.googleusercontent.com Software UploadServer / Resource Hash 27d7b573de36acef9ddbf975de05251f5219d2e4b8424288aae62aa57d5a6396 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 15:52:35 GMT content-encoding br age 882 x-guploader-uploadid ADPycdsj-VbUYeCpl6XXNSetPEpFWcyRBB48SMyrmnTXhdMMBhDRKLQswHT1zF48IzdUP7wOD5-A8E499cGp90eT1gwUJQ x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 10473 last-modified Tue, 09 Aug 2022 21:49:07 GMT server UploadServer etag W/"fe36d3317b1b052708eb2260e253aa63" vary Accept-Encoding x-goog-generation 1660081747697868 x-goog-hash crc32c=BjH7bw==, md5=/jbTMXsbBScI6yJg4lOqYw== content-type application/javascript cache-id AMS-5232d789 cache-control public,max-age=3600 x-cache-hit hit x-goog-stored-content-length 32025 accept-ranges none
GET H2	200	61eaf806342d59001e8ed916 Show response ws.zoominfo.com/pixel/	2 KB 2 KB	180ms 151ms	Script text/javascript	2606:4700::6810:a852 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/61eaf806342d59001e8ed916 Requested by Host: u6z4d6v3.rocketcdn.me URL: https://u6z4d6v3.rocketcdn.me/wp-content/cache/min/1/52ee53b339846f2bf3dc763e7d9afa19.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash b93e60e97aa7436617fb109c3aadfc8ea437d72d87ae6bbff0dd62ea22ec80d0 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:17 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 79e9740c7cd39116-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png u6z4d6v3.rocketcdn.me/wp-content/uploads/2022/06/	7 KB 8 KB	21ms 21ms	Image image/png	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Show image Full URL https://u6z4d6v3.rocketcdn.me/wp-content/uploads/2022/06/Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash 83ff020a4883eb87a2f38179cc8b9db9e867a2bd97e17aef3dcd03857369bf12 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:17 GMT last-modified Wed, 03 Aug 2022 00:00:29 GMT server nginx etag "62e9ba9d-1dc0" x-powered-by RocketCDN vary Accept-Encoding x-hw 1677254837.cds101.fr8.hn,1677254837.cds240.fr8.c content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes link <https://horizon3.ai/wp-content/uploads/2022/06/Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png>; rel="canonical" content-length 7616
GET H3	200	iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-WYiFWUU1.woff2 fonts.gstatic.com/s/rubik/v23/	20 KB 20 KB	16ms 15ms	Font font/woff2	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/rubik/v23/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-WYiFWUU1.woff2 Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f577da007c26553592d78dd093a8380759332ce8b1a4dd897f5c4ac2f4ecdb53 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.horizon3.ai/ Origin https://www.horizon3.ai accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 20:15:53 GMT x-content-type-options nosniff age 71484 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20776 x-xss-protection 0 last-modified Wed, 07 Dec 2022 18:08:44 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 23 Feb 2024 20:15:53 GMT
POST H/1.1	200 OK	PLwGhTJP Show response io.clickguard.com/r/cHJvdGVjdG9y/	0 664 B	137ms 136ms	XHR text/plain	2606:4700:20::681a:d98 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://io.clickguard.com/r/cHJvdGVjdG9y/PLwGhTJP Requested by Host: io.clickguard.com URL: https://io.clickguard.com/s/cHJvdGVjdG9y/PLwGhTJP Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:d98 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Content-Type application/json;charset=UTF-8 Response headers Date Fri, 24 Feb 2023 16:07:17 GMT via 1.1 google CF-Cache-Status DYNAMIC NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare x-powered-by Express Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xABWNLor6AWIk4%2FLZ6eepLyD7i324Zipeoe8B%2B3Ps81nvQzzx6nOhf1ZAyxtNCuLihG6r5TCtNON9MtDwCWRYMUPoREGAfxUsSYE3ah724ukORqsP3DwjqF%2F4922r856Q6D1RownO8e5ic5Elxgs"}],"group":"cf-nel","max_age":604800} access-control-allow-origin * Connection keep-alive CF-RAY 79e9740dcdd02ba9-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept Content-Length 0
OPTIONS H/1.1	200 OK	PLwGhTJP io.clickguard.com/r/cHJvdGVjdG9y/	0 0	154ms 138ms	Preflight text/html	2606:4700:20::681a:d98 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://io.clickguard.com/r/cHJvdGVjdG9y/PLwGhTJP Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:d98 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.horizon3.ai Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers CF-Cache-Status DYNAMIC CF-RAY 79e9740cec662ba9-FRA Connection keep-alive Content-Encoding br Content-Type text/html; charset=utf-8 Date Fri, 24 Feb 2023 16:07:17 GMT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4z9Sc%2F7PoxuWwnNtU0K%2BTczYg1KEGtWM6WzAYkgl1BpO6dYTM8NwwT%2FxJ5iIKda6xHejkq4XnX1riNbCxiUYCrHIj6JEV4OjWL%2F5M386zqZmgq9kftI4PzsFVOzsIwEqvDSxU6UcFP9WAIci9aeE"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept access-control-allow-origin * allow POST via 1.1 google x-powered-by Express
GET H2	200	utsync.ashx Show response ml314.com/	62 B 309 B	41ms 41ms	Script application/javascript	34.111.234.236 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=81430&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&pv=1677254837263_srmxz8h0h&bl=en-us&cb=4484894&return=&ht=&d=&dc=&si=1677254837263_srmxz8h0h&cid=6cde07f1-6e0d-4162-bf0a-d382a9285bc8&s=1600x1200&rp=&v=2.5.2.2 Requested by Host: ml314.com URL: https://ml314.com/tag.aspx?241 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.111.234.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 236.234.111.34.bc.googleusercontent.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:17 GMT via 1.1 google server Microsoft-IIS/10.0 x-aspnet-version 4.0.30319 x-powered-by ASP.NET content-type application/javascript; charset=utf-8 p3p CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA" cache-control no-cache, no-store, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 62 expires 0
GET H/1.1	200 OK	analytics Show response go.horizon3.ai/	50 B 1 KB	414ms 213ms	Script text/javascript	3.92.120.28 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://go.horizon3.ai/analytics?conly=true&visitor_id=45669568&visitor_id_sign=5deb0bcf6f1cc5980362ec62162d34833dcc814d83c6fc5f0ce034a00668ae4cdb1c4baa29b868c536b0c2921b013a23d3bfdff0&pi_opt_in=&campaign_id=17120&account_id=972073&title=Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai&url=https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/&referrer= Requested by Host: pi.pardot.com URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=17120&account_id=972073&title=Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai&url=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&referrer= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 3.92.120.28 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-92-120-28.compute-1.amazonaws.com Software PardotServer / Resource Hash dcf430710cdd1359115293f45d5023b2a560aef8a2c1e59d578b8b1e10a216d3 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache Date Fri, 24 Feb 2023 16:07:17 GMT X-Pardot-Route 9b06e8e2308c32c7bf9ba8adfb7be2e1 x-pardot-rsp 0/0/1 Server PardotServer vary User-Agent Content-Type text/javascript; charset=utf-8 p3p CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml" cache-control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 50 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	114ms 30ms	Script text/javascript	2a00:1450:400d:803::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:803::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Fri, 24 Feb 2023 15:12:19 GMT last-modified Tue, 10 Jan 2023 21:29:14 GMT server Golfe2 age 3298 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20085 expires Fri, 24 Feb 2023 17:12:19 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	33 KB 10 KB	112ms 16ms	Script application/javascript	23.65.193.7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.horizon3.ai URL: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.65.193.7 Paris, France, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-65-193-7.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash beeb705b69f299ad7567ae7ba292ae685556a7082531220a088a0d3b3307c410 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:17 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 09 Feb 2023 18:18:39 GMT server nginx/1.14.0 (Ubuntu) etag "63e538ff-820b" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 10438 expires Fri, 24 Feb 2023 16:07:17 GMT
GET		Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png u6z4d6v3.rocketcdn.me/wp-content/uploads/2022/06/	0 0
GET H2	200	Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png.webp u6z4d6v3.rocketcdn.me/wp-content/uploads/2022/06/	13 KB 13 KB	12ms 12ms	Image image/webp	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Show image Full URL https://u6z4d6v3.rocketcdn.me/wp-content/uploads/2022/06/Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png.webp Requested by Host: u6z4d6v3.rocketcdn.me URL: https://u6z4d6v3.rocketcdn.me/wp-includes/js/jquery/jquery.min.js?ver=3.6.1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software nginx / RocketCDN Resource Hash 70631b3ab478a15e8a26f17b8bb991464916725030d772237692c217e0d21334 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:17 GMT last-modified Wed, 03 Aug 2022 00:00:29 GMT server nginx etag "62e9ba9d-3214" x-powered-by RocketCDN vary Accept-Encoding x-hw 1677254837.cds101.fr8.hn,1677254837.cds330.fr8.c content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes link <https://horizon3.ai/wp-content/uploads/2022/06/Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png.webp>; rel="canonical" content-length 12820
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 822 B	51ms 20ms	XHR application/json	37.252.171.84 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.171.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 1002.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Pragma no-cache Date Fri, 24 Feb 2023 16:07:18 GMT AN-X-Request-Uuid f483cea0-dd1a-45d7-aaab-c954364a7f8d Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.horizon3.ai Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 178.162.209.140; 178.162.209.140; 1002.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 202 B	92ms 15ms	XHR text/html	23.65.193.7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.65.193.7 Paris, France, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-65-193-7.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:18 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.horizon3.ai access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	24 B 317 B	121ms 19ms	XHR text/html	2a02:26f0:f700:4bf::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:f700:4bf::1c91 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash fcfdcd4cb2d6b031d35a9afc9f38c7873268c65874d0f8cd2129a8944a8c8030 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:18 GMT vary Origin content-type text/html access-control-allow-origin https://www.horizon3.ai cache-control max-age=0, no-cache, no-store 6si-ipv6 2a00:c98:2050:a007:2::13 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="465904_34744643_51390319_20_859_18_0";dur=1 content-length 24 expires Fri, 24 Feb 2023 16:07:18 GMT
GET H2	200	linkid.js Show response www.google-analytics.com/plugins/ua/	2 KB 1 KB	30ms 29ms	Script text/javascript	2a00:1450:400d:803::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/plugins/ua/linkid.js Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:803::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 15:27:14 GMT content-encoding gzip x-content-type-options nosniff age 2404 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 859 x-xss-protection 0 last-modified Tue, 22 Oct 2019 18:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} content-type text/javascript cache-control public, max-age=3600 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" expires Fri, 24 Feb 2023 16:27:14 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	4 B 209 B	51ms 50ms	XHR text/plain	2a00:1450:400d:803::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j99&a=726748394&t=pageview&_s=1&dl=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&ul=en-us&de=UTF-8&dt=Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAAEAjQAAAACAAI~&jid=1708961677&gjid=248418577&cid=651226317.1677254837&tid=UA-158035514-1&_gid=1728589879.1677254838&_r=1&_slc=1&gtm=45He32m0n81NXGBH9M&z=1404406930 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:803::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:18 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.horizon3.ai cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	251ms 176ms	Image image/gif	23.65.193.7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=b8f835c48eb4789133c47b08c1e1e9b2&svisitor=null&visitor=9ecb01c4-fd8c-4c33-8e01-ae26aa652a3e&session=a5564d4f-1f21-4546-8cd6-9c1446f83c10&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2024%20Feb%202023%2016%3A07%3A17%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2024%20Feb%202023%2016%3A07%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22b8f835c48eb4789133c47b08c1e1e9b2%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2024%20Feb%202023%2016%3A07%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22f85e8e69ebdb261b02991e6a2a384d26f215cd42%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2024%20Feb%202023%2016%3A07%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2024%20Feb%202023%2016%3A07%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2024%20Feb%202023%2016%3A07%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs.%20This%20vulnerability%20allows%20remote%20code%20execution%20as%20the%20root%20user.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&pageViewId=19c68781-36af-4d37-8dbf-f2d33cefd258&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.65.193.7 Paris, France, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-65-193-7.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:18 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 151 B	17ms 16ms	XHR text/plain	2a00:1450:4025:402::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-158035514-1&cid=651226317.1677254837&jid=1708961677&gjid=248418577&_gid=1728589879.1677254838&_u=aCDAAEAiQAAAACAAI~&z=345712639 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4025:402::9d Den Helder, Netherlands, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Fri, 24 Feb 2023 16:07:18 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.horizon3.ai cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	36ms 36ms	Image image/gif	2a00:1450:4001:802::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-158035514-1&cid=651226317.1677254837&jid=1708961677&_u=aCDAAEAiQAAAACAAI~&z=305297169 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:18 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	38ms 38ms	Image image/gif	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-158035514-1&cid=651226317.1677254837&jid=1708961677&_u=aCDAAEAiQAAAACAAI~&z=305297169 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Fri, 24 Feb 2023 16:07:18 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	182ms 175ms	Image image/gif	23.65.193.7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=b8f835c48eb4789133c47b08c1e1e9b2&svisitor=null&visitor=9ecb01c4-fd8c-4c33-8e01-ae26aa652a3e&session=a5564d4f-1f21-4546-8cd6-9c1446f83c10&event=ipv6&q=%7B%22address%22%3A%222a00%3Ac98%3A2050%3Aa007%3A2%3A%3A13%22%7D&isIframe=false&m=%7B%22description%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs.%20This%20vulnerability%20allows%20remote%20code%20execution%20as%20the%20root%20user.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&pageViewId=19c68781-36af-4d37-8dbf-f2d33cefd258&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.65.193.7 Paris, France, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-65-193-7.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:18 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	756 B 589 B	158ms 143ms	XHR application/json	3.125.151.202 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.125.151.202 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-125-151-202.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash d96ac3de06de0a5a49356221469a414db632cd4486a405940cd839f8e23c1f83 Request headers Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ accept-language de-DE,de;q=0.9 Authorization Token f85e8e69ebdb261b02991e6a2a384d26f215cd42 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:18 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://www.horizon3.ai access-control-allow-credentials true content-length 404
OPTIONS H2	200	details epsilon.6sense.com/v3/company/	0 0	60ms 9ms	Preflight	3.125.151.202 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.125.151.202 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-125-151-202.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization Access-Control-Request-Method GET Origin https://www.horizon3.ai Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.horizon3.ai access-control-max-age 1800 date Fri, 24 Feb 2023 16:07:18 GMT server nginx
GET H3	200	collect www.google-analytics.com/	35 B 55 B	30ms 29ms	Image image/gif	2a00:1450:400d:803::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j99&a=726748394&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&ul=en-us&de=UTF-8&dt=Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aCDAAEAjQAAAACAAI~&jid=&gjid=&cid=651226317.1677254837&tid=UA-158035514-1&_gid=1728589879.1677254838&gtm=45He32m0n81NXGBH9M&cd1=&cd2=Germany&cd3=North%20Rhine-Westphalia&cd4=&cd5=&cd6=&cd7=&cd8=&cd9=&cd10=&cd11=&cd12=&z=594906364 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400d:803::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers pragma no-cache date Thu, 23 Feb 2023 21:17:21 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 67797 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	174ms 173ms	Image image/gif	23.65.193.7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=b8f835c48eb4789133c47b08c1e1e9b2&svisitor=null&visitor=9ecb01c4-fd8c-4c33-8e01-ae26aa652a3e&session=a5564d4f-1f21-4546-8cd6-9c1446f83c10&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2024%20Feb%202023%2016%3A07%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2024%20Feb%202023%2016%3A07%3A17%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs.%20This%20vulnerability%20allows%20remote%20code%20execution%20as%20the%20root%20user.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&pageViewId=19c68781-36af-4d37-8dbf-f2d33cefd258&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.65.193.7 Paris, France, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-65-193-7.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:19 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	177ms 177ms	Image image/gif	23.65.193.7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=b8f835c48eb4789133c47b08c1e1e9b2&svisitor=null&visitor=9ecb01c4-fd8c-4c33-8e01-ae26aa652a3e&session=a5564d4f-1f21-4546-8cd6-9c1446f83c10&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2024%20Feb%202023%2016%3A07%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2024%20Feb%202023%2016%3A07%3A18%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs.%20This%20vulnerability%20allows%20remote%20code%20execution%20as%20the%20root%20user.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&pageViewId=19c68781-36af-4d37-8dbf-f2d33cefd258&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.65.193.7 Paris, France, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-65-193-7.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:20 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	178ms 178ms	Image image/gif	23.65.193.7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=b8f835c48eb4789133c47b08c1e1e9b2&svisitor=null&visitor=9ecb01c4-fd8c-4c33-8e01-ae26aa652a3e&session=a5564d4f-1f21-4546-8cd6-9c1446f83c10&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2024%20Feb%202023%2016%3A07%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2024%20Feb%202023%2016%3A07%3A19%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs.%20This%20vulnerability%20allows%20remote%20code%20execution%20as%20the%20root%20user.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&pageViewId=19c68781-36af-4d37-8dbf-f2d33cefd258&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.65.193.7 Paris, France, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-65-193-7.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:21 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	174ms 173ms	Image image/gif	23.65.193.7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=b8f835c48eb4789133c47b08c1e1e9b2&svisitor=null&visitor=9ecb01c4-fd8c-4c33-8e01-ae26aa652a3e&session=a5564d4f-1f21-4546-8cd6-9c1446f83c10&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2024%20Feb%202023%2016%3A07%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2024%20Feb%202023%2016%3A07%3A20%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs.%20This%20vulnerability%20allows%20remote%20code%20execution%20as%20the%20root%20user.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Fortinet%20FortiNAC%20CVE-2022-39952%20Deep-Dive%20and%20IOCs%20%E2%80%93%20Horizon3.ai%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.horizon3.ai%2Ffortinet-fortinac-cve-2022-39952-deep-dive-and-iocs%2F&pageViewId=19c68781-36af-4d37-8dbf-f2d33cefd258&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.65.193.7 Paris, France, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-65-193-7.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 24 Feb 2023 16:07:22 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

u6z4d6v3.rocketcdn.me

URL

https://u6z4d6v3.rocketcdn.me/wp-content/uploads/2022/06/Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png