www.fortinet.com Open in urlscan Pro
18.156.16.255  Public Scan

12 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

36 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request phishing-campaign-delivering-fileless-malware Show response www.fortinet.com/blog/threat-research/	51 KB 18 KB	688ms 620ms	Document text/html	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 0cbb486b3b60de65650d50547cb4b65c39692d7d7d125c006b7b75d5b66359f9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Cache-Control max-age=600, public Connection keep-alive Content-Encoding gzip Content-Length 17900 Content-Type text/html;charset=utf-8 Date Tue, 17 May 2022 12:23:08 GMT ETag "ca80-5df33e408ae72-gzip" Last-Modified Tue, 17 May 2022 12:00:45 GMT Server Apache Strict-Transport-Security max-age=31536000; includeSubDomains Vary Accept-Encoding,User-Agent X-Content-Type-Options nosniff X-Dispatcher dispatcher1uswest1 X-Frame-Options SAMEORIGIN X-Vhost publish X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	clientlib-base.min.css www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/	217 KB 27 KB	168ms 168ms	Stylesheet text/css	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css?v=1 Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 9af0506f7d0221d9049280d06c6af4bc060a54a9657bbdef66bc3e85b8d00904 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Tue, 17 May 2022 12:23:09 GMT Content-Encoding gzip X-Content-Type-Options nosniff X-Vhost publish Connection keep-alive Vary Accept-Encoding,User-Agent Content-Length 27089 X-XSS-Protection 1; mode=block Last-Modified Fri, 29 Apr 2022 21:06:27 GMT Server Apache X-Frame-Options SAMEORIGIN ETag "3628c-5ddd16a6d3ac0-gzip" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type text/css;charset=utf-8 Cache-Control max-age=684000, public Accept-Ranges bytes
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	20 KB 7 KB	58ms 19ms	Script application/javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 03aa6fcac2902227e1b66a01b87824692f708bbf9bfe441784f8ed22d677f6de Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:23:09 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 +q2Bd0SvXowDeesSOf+0yw== age 150 vary Accept-Encoding content-length 6782 x-ms-lease-status unlocked last-modified Fri, 13 May 2022 12:13:28 GMT server cloudflare etag 0x8DA34D9FD30D37D expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 461614fa-001e-005d-4ad7-6628e2000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc529a9fea23af-ZRH
GET H2	200	marvel.js Show response marvel-b2-cdn.bc0a.com/	9 KB 4 KB	30ms 8ms	Script application/javascript	35.201.125.192 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://marvel-b2-cdn.bc0a.com/marvel.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.201.125.192 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 192.125.201.35.bc.googleusercontent.com Software UploadServer / Resource Hash 965fc05b277596a937ba9d14388799fd5217eb96179f0187b8b937347bdfaf59 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:17:52 GMT content-encoding gzip age 317 x-guploader-uploadid ADPycdsYb1d-ftSveyADdfk3llPl976jehNNc2b9gOYayImFSz6ud4p3WO-MgkA9_4WAeXObqrMMUrDrNRuFX04uuiNDgg x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 2 x-goog-stored-content-encoding gzip alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3217 last-modified Wed, 01 Sep 2021 18:16:49 GMT server UploadServer etag "5a385b6f8bc7f4775b2ec7b66c0ec4c2" vary Accept-Encoding x-goog-hash crc32c=0X9o7A==, md5=Wjhbb4vH9HdbLse2bA7Ewg== content-language en access-control-allow-origin * x-goog-generation 1630520209881243 access-control-expose-headers Content-Type cache-control public, max-age=3600 x-goog-stored-content-length 3217 accept-ranges bytes content-type application/javascript expires Tue, 17 May 2022 13:17:52 GMT
GET H/1.1	200 OK	fortinet-logo-white.svg www.fortinet.com/content/dam/fortinet-blog/	32 KB 3 KB	161ms 160ms	Image image/svg+xml	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Tue, 17 May 2022 12:23:09 GMT Content-Encoding gzip X-Content-Type-Options nosniff X-Vhost publish Content-Disposition attachment; filename="fortinet-logo-white.svg" Connection keep-alive Vary Accept-Encoding,User-Agent Content-Length 1998 X-XSS-Protection 1; mode=block Last-Modified Thu, 22 Feb 2018 23:16:01 GMT Server Apache X-Frame-Options SAMEORIGIN ETag "7ebb-565d53a1d6e40-gzip" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type image/svg+xml Cache-Control max-age=684000, public Accept-Ranges bytes
GET H/1.1	200 OK	clientlib-base.min.js Show response www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/	150 KB 69 KB	950ms 927ms	Script application/javascript	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 1e1a42cb75ebd81eb31850e485ef4c6e3667a45f57f778f249bca1f2852a97e4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Tue, 17 May 2022 12:23:09 GMT Content-Encoding gzip X-Content-Type-Options nosniff X-Vhost publish Connection keep-alive Vary Accept-Encoding,User-Agent Content-Length 70015 X-XSS-Protection 1; mode=block Last-Modified Thu, 14 Jan 2021 20:18:39 GMT Server Apache X-Frame-Options SAMEORIGIN ETag "25644-5b8e1f610c5c0-gzip" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type application/javascript;charset=utf-8 Cache-Control max-age=684000, public Accept-Ranges bytes
GET H2	200	f85f39fc-d7aa-467a-b762-fbb722748016.json Show response cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/	4 KB 2 KB	48ms 22ms	XHR application/x-javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a334f368b502d68bcaafb174022cfe21775f1744f0a1cd520d0c57d094a8e66a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:23:09 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 ypNp2Paf3c+p42YUXiXMnA== age 7124 vary Accept-Encoding content-length 1413 x-ms-lease-status unlocked last-modified Fri, 12 Feb 2021 00:26:33 GMT server cloudflare etag 0x8D8CEECD9FE5833 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id eb90fc9a-301e-013c-6b15-b62a68000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc529bac730204-ZRH expires Tue, 17 May 2022 16:23:09 GMT
GET DATA	200 OK	truncated /	71 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type image/png
GET H2	200	phishing-bitrat-pandora-part-one-hero.jpg marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/	38 KB 38 KB	78ms 33ms	Image image/webp	2600:9000:2057:8c00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/phishing-bitrat-pandora-part-one-hero.jpg Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:8c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 57ca15ddb2fd45861fd4414dd2e205297188620cddb44b316c497c3f2c104d04 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id 1LGhphIgslTYhsMhATmml4SJRgcDpmcz via 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront) etag "64aec2d0e7851def1e9c69f238f17ffd" age 21021 x-cache Hit from cloudfront x-amz-request-id CJZWSS6CGYDSKX90 x-amz-id-2 SQpeB/Ifc0wR8OKE7PUPGMDFfNm0C0FpylK7oesbSU1zyBfTwue4g8f/Zk+qRHvoNigsLU4aH1E= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:39 GMT server AmazonS3 date Tue, 17 May 2022 06:32:49 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 38714 x-amz-cf-id YCpu7ADD1mBbGoxoytzpzlUgyQqv-LtntDMv8ncv9sE4O-tvBaMW7g==
GET H2	200	what-s-cooking-dridex-s-new-and-undiscovered-recipes.png.thumb.319.319.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/	5 KB 6 KB	90ms 67ms	Image image/webp	2600:9000:2057:8c00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/what-s-cooking-dridex-s-new-and-undiscovered-recipes.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:8c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e9d0dce3bffb12ae344ee055850d36f892c0c00f5e3d3975bd71970288fcc35d Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id 62IDYmfEORDzkYlucXEqZtt7a1zBK6Ed via 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront) etag "68bd98881d9b8a939de22d56665954d9" age 27202 x-cache Hit from cloudfront x-amz-request-id FT3CX4Z47YHVWHB3 x-amz-id-2 6a66tjhWBWY/gjTDzKbjWyUx50Y6ZvZXjdPd2ylU4dJzpowWko35eI0Dzg+Tx4NcYnUu4qHI56Y= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:38 GMT server AmazonS3 date Tue, 17 May 2022 04:49:48 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 5188 x-amz-cf-id 8Ey9MdIa6FAPwmp2Ez1Efmky8PV4qOwKIoLB51z8QnSHu4Y40YIbdQ==
GET H2	200	elec1.png.thumb.319.319.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/	25 KB 26 KB	64ms 42ms	Image image/webp	2600:9000:2057:8c00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/elec1.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:8c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash b29b1388d9b4de4ac0d5ba8b5c171174485de67babfb8114c2ee80d793372501 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id GQOzBl27KqEoXXJr4wkleG4_vORfqpg0 via 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront) etag "355365f99f3ef55de87738cf968464a5" age 14874 x-cache Hit from cloudfront x-amz-request-id DDMNN59VHY6K88NP x-amz-id-2 ItKJyfDVxYFpLZME8AMGO7KSgXu5qeT2lBIjmYRmkXvAouiWD0aMwGT5dt4U6be3F0rzdZxzugQ= accept-ranges bytes last-modified Fri, 29 Apr 2022 20:41:13 GMT server AmazonS3 date Tue, 17 May 2022 08:15:16 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 25882 x-amz-cf-id NTfLoydxx4KJuvWMrj-qESmVP-zDVufSrQPF6ANFuJgvb_6VBeBiaQ==
GET H2	200	did-you-order-those-itunes-movies-nope-its-just-phishing-for-canadian-apple-users.jpg.thumb.319.319.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/	9 KB 10 KB	54ms 32ms	Image image/webp	2600:9000:2057:8c00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/did-you-order-those-itunes-movies-nope-its-just-phishing-for-canadian-apple-users.jpg.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:8c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash de95c5c99f44c4d380f8840a837e73dfbbe2f67fd64c2549e7b871d522af05f6 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id gAsu98vCqRKHYBNgQH52bb._6OKZqCuJ via 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront) etag "740a2070c4f966bb6042881a216f7f2a" age 21021 x-cache Hit from cloudfront x-amz-request-id CJZJGNFC2G731GJH x-amz-id-2 SxaeeRO6CiStFoi+edGQFj+dec59QECT3/YeS4A758/oio+hsTQZx1BzL7CW0J/sidSvV6AnY6Y= accept-ranges bytes last-modified Fri, 29 Apr 2022 21:31:50 GMT server AmazonS3 date Tue, 17 May 2022 06:32:49 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 9656 x-amz-cf-id j6N8kU7mXDNTEY5TRnhbsdKR6xGgEH4FqQARcmENoGH8hT-lXV4EKA==
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	182 B 457 B	118ms 50ms	XHR application/json	2606:4700:10::6814:b844 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept application/json Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:23:09 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET, OPTIONS content-type application/json access-control-allow-origin * strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 70cc529c5eb50229-ZRH access-control-allow-headers Content-Type
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.10.0/	356 KB 78 KB	21ms 21ms	Script application/javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:23:09 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 Bh9exWOPGIwRshWljrtlEw== age 18195297 vary Accept-Encoding content-length 79698 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:43:00 GMT server cloudflare etag 0x8D89735260901BC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 73bec284-d01e-0098-476c-c456d9000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc529caab823af-ZRH
GET H2	200	en.json Show response cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/2149c787-bccf-419d-b831-2a3ac6bafc66/	62 KB 14 KB	30ms 30ms	Fetch application/x-javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/2149c787-bccf-419d-b831-2a3ac6bafc66/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 047f3105c9c1c03b56fb255cbb8cbfbad3a41aeab4928d722f42be59e48175fb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:23:09 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 PDee2klF9h+xwI77VTWe9Q== age 2704 vary Accept-Encoding content-length 14507 x-ms-lease-status unlocked last-modified Fri, 12 Feb 2021 00:26:39 GMT server cloudflare etag 0x8D8CEECDD98A1AE expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id dc7eeb81-101e-016f-2b42-ca3667000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc529cee170204-ZRH expires Tue, 17 May 2022 16:23:09 GMT
GET H2	200	otCenterRounded.json Show response cdn.cookielaw.org/scripttemplates/6.10.0/assets/	9 KB 3 KB	24ms 23ms	Fetch application/json	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otCenterRounded.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:23:09 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 SH1nUCPouc1JVrHnvxpQbg== age 10199 vary Accept-Encoding content-length 2857 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:42:51 GMT server cloudflare etag 0x8D89735210A49EB expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 881308d7-101e-012b-396e-c9ea0b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc529d2e850204-ZRH
GET H2	200	otPcTab.json Show response cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/	45 KB 12 KB	24ms 24ms	Fetch application/json	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:23:09 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 zNsRoM1FEmsEgJoYMCNTng== age 18195108 vary Accept-Encoding content-length 11755 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:42:53 GMT server cloudflare etag 0x8D897352245C4EA expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 20548eff-101e-0102-2b6d-c49c49000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc529d2e870204-ZRH
GET DATA	200 OK	truncated /	42 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	fig1.1..png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image.img.png/1652300705505/	15 KB 15 KB	52ms 52ms	Image image/webp	2600:9000:2057:8c00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image.img.png/1652300705505/fig1.1..png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:8c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e483afa5e94a986f46186c517c0fa299da8a7e815d85296c735e05accab0cc47 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id I05h4_oG1IlDz51UTAgmDGH6kz19sTpu via 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront) etag "eca8b86858cd50d6846402c716152fd3" age 62649 x-cache Hit from cloudfront x-amz-request-id M2DC19QBQ5A5PQ8H x-amz-id-2 nuRqo2vHsUC5/1oEl+aktlYejFnD73f6VuivyynDKTLlWf1lv3ac0cXt5rOgOt8wdDn/Rn/eUHY= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:44 GMT server AmazonS3 date Mon, 16 May 2022 18:59:02 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 15168 x-amz-cf-id K6Ey_db879LoYS0HNOGbUhrDmKDOn6LWuogHf1gx_E541GzwYCgSRQ==
GET H2	200	fig2.1.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image_898255838.img.png/1652300758381/	27 KB 27 KB	38ms 38ms	Image image/webp	2600:9000:2057:8c00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image_898255838.img.png/1652300758381/fig2.1.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:8c00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 64bcc0986ce10299c4ffe23c2252e9c3274c33a6a906d337d0b183ea6a6d3c74 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id lfDNKnACBXQCGnWmcNT6wK6loJshmsEE via 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront) etag "d1ae6939653cfae3464073220dded0b2" age 59825 x-cache Hit from cloudfront x-amz-request-id S7KQCKQ42BK589X4 x-amz-id-2 ghQUS+OGJXSgJy7CYtLDdllc2TUoSMj92zQy4f/y0pw8MOgzLCTy3FyBnsioNYRmHQ9lfdtNpGw= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:39 GMT server AmazonS3 date Mon, 16 May 2022 19:46:06 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 27410 x-amz-cf-id CsMXZNXV8A6REbllKC-2Bj84t6mRRf4S3rCwm340ZRbuxWES1PSE3w==
GET H2	200	launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response assets.adobedtm.com/	369 KB 79 KB	48ms 7ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash be3cd2bf4ffcefbf9a4d2bf38f533d465d8152bf709b08c265b4844e551e36ef Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:23:10 GMT content-encoding gzip last-modified Mon, 09 May 2022 18:08:52 GMT server AkamaiNetStorage etag "4135345c405e42f8bb2ac55345c3f523:1652119732.361675" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 80750 expires Tue, 17 May 2022 13:23:10 GMT
GET H2	200	AppMeasurement.min.js Show response assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/	33 KB 12 KB	8ms 7ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/AppMeasurement.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 055e467aa53a9c0272d805bbc009ade8c74df5a8c1255271d753ac78fe179873 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:23:10 GMT content-encoding gzip last-modified Wed, 19 Jan 2022 22:18:26 GMT server AkamaiNetStorage etag "85722a02b6a7feb74d08ac7875516bee:1642630706.903013" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 12243 expires Tue, 17 May 2022 13:23:10 GMT
GET H2	200	AppMeasurement_Module_ActivityMap.min.js Show response assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/	3 KB 2 KB	8ms 8ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/AppMeasurement_Module_ActivityMap.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash d4e77c7411d1de6efebf4278b9c98aa77dc2e5186cee271ac256138f17bef9f4 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:23:10 GMT content-encoding gzip last-modified Wed, 19 Jan 2022 22:18:27 GMT server AkamaiNetStorage etag "9355415074dbdbd216a19b61ce931ab2:1642630707.219535" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 1599 expires Tue, 17 May 2022 13:23:10 GMT
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	31 KB 10 KB	64ms 13ms	Script application/javascript	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:23:10 GMT Content-Encoding gzip X-Content-Type-Options nosniff Connection keep-alive Vary Accept-Encoding Content-Length 9715 Pragma no-cache Last-Modified Thu, 05 May 2022 03:45:17 GMT Server nginx/1.14.0 (Ubuntu) ETag "6273484d-7b02" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Cache-Control private, no-cache, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Tue, 17 May 2022 12:23:10 GMT
GET H2	200	RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/	358 B 494 B	8ms 7ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash d37e860faf31e1770a95e1d7ed540106a515cac001640c72562495db0e4038dc Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:23:10 GMT content-encoding gzip last-modified Mon, 09 May 2022 18:08:53 GMT server AkamaiNetStorage etag "2ef360583ccf0b27275ca758741f8b74:1652119733.259967" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 228 expires Tue, 17 May 2022 13:23:10 GMT
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 702 B	42ms 20ms	XHR application/json	37.252.172.36 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.172.36 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Pragma no-cache Date Tue, 17 May 2022 12:23:10 GMT X-Proxy-Origin 146.70.117.85; 146.70.117.85; 692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com AN-X-Request-Uuid 5b8d854f-c483-4515-8ad0-9357a768fe49 Server nginx/1.21.3 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.fortinet.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 372 B	51ms 13ms	XHR text/plain	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software / Resource Hash 6bd4f0cad0dc4805ec285e39b7aaf7990a58a53a3ed1529616f29767ff583abf Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:23:10 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://www.fortinet.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H2	200	/ Show response ipv6.6sc.co/	19 B 254 B	74ms 22ms	XHR text/html	2a02:26f0:6c00:296::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:296::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 200d74a734a345df63aae0a13c86291186b12f3f2a1e074c470db5d52c16a057 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers pragma no-cache date Tue, 17 May 2022 12:23:10 GMT vary Origin content-type text/html access-control-allow-origin https://www.fortinet.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:ac8:20:271::1e server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 19 expires Tue, 17 May 2022 12:23:10 GMT
GET H2	200	RC3bae6526bab9473dbbab7449e16ead11-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/	579 B 586 B	8ms 8ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/RC3bae6526bab9473dbbab7449e16ead11-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 40cd024adb08f8eaf0a032eee9f3e9a9578cb7b7be0d34af04cc57a58dbfd46d Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:23:10 GMT content-encoding gzip last-modified Mon, 09 May 2022 18:08:53 GMT server AkamaiNetStorage etag "2ef360583ccf0b27275ca758741f8b74:1652119733.259967" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 320 expires Tue, 17 May 2022 13:23:10 GMT
GET H2	200	RCe61896415d84436c959b7a66783b3417-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/	1 KB 817 B	11ms 11ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/RCe61896415d84436c959b7a66783b3417-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 57cc8b4faf7c9e7e42330844dbaa3ac52aaa17eedc656644a47b18bfffb4a884 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:23:10 GMT content-encoding gzip last-modified Mon, 09 May 2022 18:08:53 GMT server AkamaiNetStorage etag "2ef360583ccf0b27275ca758741f8b74:1652119733.259967" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 550 expires Tue, 17 May 2022 13:23:10 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	227ms 190ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&session=fc5361df-53ae-4a46-8b92-e29b068967a1&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A23%3A10%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=4d925a52-99a1-4af9-85df-e6fea1e51daa&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:23:10 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	439 B 428 B	25ms 10ms	XHR application/json	52.57.195.65 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.195.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-195-65.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 29162f230e0ad410f48cc6a277c3a38dcd472d621362f34d269d726ecc8d3850 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 Authorization Token 82f0c18bd0395219670f57108eb160f3273629b2 EpsilonCookie cbd5ce178c6c0000ae938362a1010000a8108600 Response headers date Tue, 17 May 2022 12:23:10 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://www.fortinet.com access-control-allow-credentials true content-length 242
OPTIONS H2	200	details epsilon.6sense.com/v3/company/	0 0	65ms 8ms	Preflight	52.57.195.65 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.195.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-195-65.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,epsiloncookie Access-Control-Request-Method GET Origin https://www.fortinet.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,epsiloncookie access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.fortinet.com access-control-max-age 1800 date Tue, 17 May 2022 12:23:10 GMT server nginx
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	227ms 200ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000ae938362a1010000a8108600&session=fc5361df-53ae-4a46-8b92-e29b068967a1&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A271%3A%3A1e%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=4d925a52-99a1-4af9-85df-e6fea1e51daa&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:23:10 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	197ms 197ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000ae938362a1010000a8108600&session=fc5361df-53ae-4a46-8b92-e29b068967a1&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A23%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A23%3A10%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=4d925a52-99a1-4af9-85df-e6fea1e51daa&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:23:11 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	190ms 190ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000ae938362a1010000a8108600&session=fc5361df-53ae-4a46-8b92-e29b068967a1&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A23%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A23%3A11%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=4d925a52-99a1-4af9-85df-e6fea1e51daa&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:23:12 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	197ms 196ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000ae938362a1010000a8108600&session=fc5361df-53ae-4a46-8b92-e29b068967a1&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A23%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A23%3A12%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=4d925a52-99a1-4af9-85df-e6fea1e51daa&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:23:13 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	190ms 190ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000ae938362a1010000a8108600&session=fc5361df-53ae-4a46-8b92-e29b068967a1&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A23%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A23%3A13%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=4d925a52-99a1-4af9-85df-e6fea1e51daa&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:23:14 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT

68 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails object| OneTrustStub function| OptanonWrapper function| enableMarvel string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| Optanon object| OneTrust object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| setImmediate function| clearImmediate function| $ function| jQuery object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in number| timer_e object| _6si function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq boolean| _storagePopulated

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.fortinet.com/	1970-01-20 11:52:06	Name: cookiesession1 Value: 678A3E26BC851F36C934E69FE5771785
			.fortinet.com/	1970-01-20 11:52:06	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Tue+May+17+2022+12%3A23%3A10+GMT%2B0000+(GMT)&version=6.10.0&hosts=&consentId=653e02d6-68cd-4f4a-8e20-f18dd72c53a7&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
			.6sc.co/	1970-01-20 20:37:42	Name: 6suuid Value: cbd5ce178c6c0000ae938362a1010000a8108600
			www.fortinet.com/	1970-01-20 03:16:34	Name: _an_uid Value: 0
			www.fortinet.com/	1970-01-20 20:37:42	Name: _gd_visitor Value: 4d569f97-42b7-42b8-8f4e-51a307b3ca50
			www.fortinet.com/	1970-01-20 03:06:44	Name: _gd_session Value: fc5361df-53ae-4a46-8b92-e29b068967a1
			www.fortinet.com/	1970-01-20 20:37:42	Name: _gd_svisitor Value: cbd5ce178c6c0000ae938362a1010000a8108600

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block