www.fortinet.com Open in urlscan Pro
18.156.16.255  Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37

• https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s26785124507571?AQB=1&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A24%203%20-60&fid=5A6F09BF6CF46659-099FB6D7233B96AB&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
• https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s26785124507571?AQB=1&pccr=true&vidn=32CA8CDC7825B778-60000728203F849C&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A24%203%20-60&fid=5A6F09BF6CF46659-099FB6D7233B96AB&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

39 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request bandook-persistent-threat-that-keeps-evolving Show response www.fortinet.com/blog/threat-research/	51 KB 18 KB	170ms 47ms	Document text/html	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 2221e75da3dd41538fba684b5355135d4bd0e73bfb1c0042aa9fcece1e82858f Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Age 44552 Cache-Control max-age=600, public, s-maxage=10800 Connection keep-alive Content-Encoding gzip Content-Length 17312 Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Content-Type text/html;charset=utf-8 Date Wed, 03 Jan 2024 08:20:48 GMT ETag "cce4-60dfbf8205f92-gzip" Last-Modified Tue, 02 Jan 2024 20:01:51 GMT Server Apache Strict-Transport-Security max-age=31536000; includeSubDomains Vary Accept-Encoding Via 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront) X-Amz-Cf-Id tq0DbpCecj9_zG9lZnDQYopddkhSI5jQNv6ctHozLz6yoZX6IV71qg== X-Amz-Cf-Pop FRA60-P3 X-Cache Hit from cloudfront X-Content-Type-Options nosniff X-Dispatcher dispatcher1uswest1 X-Frame-Options SAMEORIGIN X-Vhost publish X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	at.js Show response www.fortinet.com/etc/designs/fortinet/adb-target/	104 KB 48 KB	125ms 51ms	Script application/javascript	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 27 Dec 2023 18:59:53 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Content-Encoding gzip Via 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 X-Vhost publish X-Cache Hit from cloudfront Age 566669 Connection keep-alive Content-Length 47782 X-XSS-Protection 1; mode=block Last-Modified Fri, 31 Mar 2023 18:09:20 GMT Server Apache ETag "19e83-5f8361bb01400-gzip" X-Frame-Options SAMEORIGIN Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id o5B-stEN3BuCJmD8165sd_D46eb9A0fswem6SGsfUnLWCBy_thmX5A==
GET H/1.1	200 OK	clientlib-base.min.css www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/	540 KB 28 KB	72ms 44ms	Stylesheet text/css	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash bf19e4cab46ebfd04a1438e21bc98c6f520c476918f71d44a96d2523fe0abec4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 03 Jan 2024 08:18:01 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Content-Encoding gzip Via 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 X-Vhost publish X-Cache Hit from cloudfront Age 1607845 Connection keep-alive Content-Length 27479 X-XSS-Protection 1; mode=block Last-Modified Thu, 02 Nov 2023 22:08:43 GMT Server Apache ETag "86e18-60932a18310c0-gzip" X-Frame-Options SAMEORIGIN Vary Accept-Encoding Content-Type text/css;charset=utf-8 Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id p55Yc_1ng_bhTDYzqIiijcLxoUuAf6y1TYHk-BkNSOJujJeodnR8yw==
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	21 KB 7 KB	131ms 50ms	Script application/javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6d72fa0f78c80b1874d3ee4aadf43d973edc442a65fef83d37e684ac559893b7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:23 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 5rel+BW+cbOCNkEJ4C4NBQ== age 11755 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 6841 x-ms-lease-status unlocked last-modified Thu, 21 Dec 2023 21:19:55 GMT server cloudflare etag 0x8DC026A943751A5 vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id d530a67f-201e-0007-3283-3455e0000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d85a382639da-FRA
GET H/1.1	200 OK	fortinet-logo-white.svg www.fortinet.com/content/dam/fortinet-blog/	32 KB 3 KB	167ms 47ms	Image image/svg+xml	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 03 Jan 2024 08:18:01 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Content-Encoding gzip Via 1.1 6fc439c8bc0a64a7ab978ce699795274.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 X-Vhost publish X-Cache Hit from cloudfront Age 11474582 Content-Disposition attachment; filename="fortinet-logo-white.svg" Connection keep-alive Content-Length 1998 X-XSS-Protection 1; mode=block Last-Modified Thu, 22 Feb 2018 23:16:01 GMT Server Apache ETag "7ebb-565d53a1d6e40-gzip" X-Frame-Options SAMEORIGIN Vary Accept-Encoding Content-Type image/svg+xml Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id nek3LnVHgWldmTXpiKzGGbP06LRTxdwlRI47vXRkMI0U_dO-8MoRog==
GET H/1.1	200 OK	toc-icon.jpg www.fortinet.com/content/dam/fortinet/images/	1 KB 3 KB	168ms 47ms	Image image/jpeg	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 03 Jan 2024 08:20:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 4286999 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 1277 X-XSS-Protection 1; mode=block Last-Modified Tue, 14 Nov 2023 17:34:13 GMT Server Apache ETag "4fd-60a2031eb4f40" X-Frame-Options SAMEORIGIN Content-Type image/jpeg Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id xz2o-Vp6HsHbzooSJ2Lg_T4f_eQMWofxce5uIxJ47xH6i65XdlAjPQ==
GET H/1.1	200 OK	clientlib-base.min.js Show response www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/	155 KB 71 KB	49ms 48ms	Script application/javascript	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 9025f5763fcba60d492d22d0e56c3cfc022b41280a3bbcf78fb12bf4306cd0b0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Tue, 02 Jan 2024 09:20:19 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Content-Encoding gzip Via 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 X-Vhost publish X-Cache Hit from cloudfront Age 83044 Connection keep-alive Content-Length 71667 X-XSS-Protection 1; mode=block Last-Modified Thu, 14 Dec 2023 22:43:09 GMT Server Apache ETag "26be7-60c8001fd7940-gzip" X-Frame-Options SAMEORIGIN Vary Accept-Encoding Content-Type application/javascript;charset=utf-8 Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id eKGpf2FL4C1tc7fWm6nJlIljDMqEqzgryvq8F-5C2gy9U8iDGIdzvg==
GET H2	200	f85f39fc-d7aa-467a-b762-fbb722748016.json Show response cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/	5 KB 2 KB	134ms 55ms	XHR application/x-javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:23 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 43561 content-md5 Uj3iBUKm1Vl2g2NHq67V+w== content-length 1792 x-ms-lease-status unlocked last-modified Thu, 28 Dec 2023 19:56:54 GMT server cloudflare etag 0x8DC07DF23DF5130 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 67257c4e-101e-0033-60c8-396628000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d85b18853620-FRA expires Thu, 04 Jan 2024 08:24:23 GMT
GET DATA	200 OK	truncated /	71 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	mandook-hero.png www.fortinet.com/content/dam/fortinet-blog/article-heros/	325 KB 327 KB	47ms 47ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/article-heros/mandook-hero.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 45afacae575d4b5b9246fc189ab92cd3ab923a03cc57bf7b02d844fb1c709113 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 08:20:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 1095549 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 333102 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:46:19 GMT Server Apache ETag "5152e-60cdf9b0facc0" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id vAHRy-6ix_C4AC2BDC707pEUq8UTwzGYq8dEGqpyw6se8hmHKCPO3A==
GET H/1.1	200 OK	teamcity-thumbnail.png.thumb.319.319.png www.fortinet.com/content/dam/fortinet-blog/article-heros/	52 KB 53 KB	46ms 46ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/article-heros/teamcity-thumbnail.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 7a7926b29f0f2803f7767e7a018783891498cb6a76c0abb5cd2bc0e9400c5dd3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 03 Jan 2024 08:20:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 2a44338adc8233e5b25aca28287a69c8.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 1095691 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 53049 X-XSS-Protection 1; mode=block Last-Modified Sat, 09 Dec 2023 00:56:24 GMT Server Apache ETag "cf39-60c092b7b3e00" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id Bbrpk3mkwbXxKdwYzYVqdd1SBT__5pIox_B0y9qpumQmqXY0CyZ7Ug==
GET H/1.1	200 OK	mranon-stealer-thumbnail.png.thumb.319.319.png www.fortinet.com/content/dam/fortinet-blog/article-heros/	49 KB 51 KB	73ms 49ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/article-heros/mranon-stealer-thumbnail.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 6693ca64ed25947f20674723a171270855165f18faefe98c273031877041ecc2 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 08:20:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 1782927 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 50560 X-XSS-Protection 1; mode=block Last-Modified Tue, 05 Dec 2023 15:41:05 GMT Server Apache ETag "c580-60bc50ffd8640" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id O0PbbZnvt5W1uEDD6ZnlOiFjKU5Oz9grN9mhw1x_PF7sg3B58rtN9A==
GET H/1.1	200 OK	gotitan-thumbnail.png.thumb.319.319.png www.fortinet.com/content/dam/fortinet-blog/article-heros/	44 KB 46 KB	56ms 42ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/article-heros/gotitan-thumbnail.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash d687db0c07ec775db39e2ea1ef235a8f7e65c5600e0b75697eb8c21002a51780 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 03 Jan 2024 08:20:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 1095690 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 45240 X-XSS-Protection 1; mode=block Last-Modified Wed, 22 Nov 2023 19:52:09 GMT Server Apache ETag "b0b8-60ac30df00c40" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id GOBLiI8FUQdBW4kf8nV9qwq2nxZG-UIgfAq-O49NYKb2xgBR7TIsfg==
GET H/1.1	200 OK	UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 www.fortinet.com/etc/designs/fortinet/gfonts/	37 KB 38 KB	86ms 64ms	Font application/octet-stream	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 Requested by Host: www.fortinet.com URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css Origin https://www.fortinet.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Tue, 19 Dec 2023 19:39:43 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 6fc439c8bc0a64a7ab978ce699795274.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 1255558 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 37716 X-XSS-Protection 1; mode=block Last-Modified Wed, 18 May 2022 21:08:06 GMT Server Apache ETag "9354-5df4fa74ff980" X-Frame-Options SAMEORIGIN Content-Type application/octet-stream Cache-Control max-age=2000000, public Accept-Ranges bytes X-Amz-Cf-Id Qn5lSycP0X9WH2zbUGWsUioo84NNM4pXVMtkqalH6TqIbrMHHetsOw==
GET H/1.1	200 OK	fig01-bandook-registry-keys-written.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1049625597.img.png/1702997925527/	58 KB 59 KB	72ms 42ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1049625597.img.png/1702997925527/fig01-bandook-registry-keys-written.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 371c9597b00819e8e4a4f2035c0997e2a30c482e874d88eab69bb81146bafa46 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:17 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 53760 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 59238 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 14:58:45 GMT Server Apache ETag "e766-60cde1a5f7340" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id NpXgTwcfuRN7Xobo2Eqby1lK8KPe3T4VfbEhm4CiEz4CcnQe_Q6eqA==
GET DATA	200 OK	truncated /	42 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Content-Type image/gif
GET H/1.1	200 OK	fig02-bandook-payload-execution-flow.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1906578527.img.png/1702997942101/	49 KB 50 KB	86ms 42ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1906578527.img.png/1702997942101/fig02-bandook-payload-execution-flow.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 8f5151071c493e7a759e47b198f17a3e5a9bb0cd5e79579d6bbbc7c31125a058 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:17 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 2a44338adc8233e5b25aca28287a69c8.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 51964 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 50271 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 14:59:02 GMT Server Apache ETag "c45f-60cde1b62d980" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id 9IK1waiOKPCpGbyP0XU5ettr4v4f3qRXII1Vyqjmgam9SmejY2DbfA==
GET H/1.1	200 OK	fig03-bandook-relationship-value-cmd-payload.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1702998011262/	78 KB 80 KB	48ms 46ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1702998011262/fig03-bandook-relationship-value-cmd-payload.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 56efa8f091bacb485ca34ebcb2efc799c4a7d1b5de7162a657caf0a49932b432 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 372875ad1ec20daf24f3f29f14a73cd0.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 53760 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 80199 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 15:00:11 GMT Server Apache ETag "13947-60cde1f7fb4c0" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id OyX1PdxqGjvRRZ_jg4D_ll7HOWvWcPl_C41pXlI_Tyd30qrv4Fjw8w==
GET H/1.1	200 OK	fig04-bandook-traffic-capture-aes-decrypted-data.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_434310331.img.png/1702998030791/	113 KB 114 KB	42ms 42ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_434310331.img.png/1702998030791/fig04-bandook-traffic-capture-aes-decrypted-data.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash c43ffae5330275f609cbe1bca236321134ceaa5af31923ea4c5076438050950a Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 53760 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 115702 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 15:00:30 GMT Server Apache ETag "1c3f6-60cde20a19f80" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id m2HmX1TrBGbYrKHAagyN34eZpZukLBhKPbAjMXKMDNx__oblK1rsXg==
GET H/1.1	200 OK	fig05-bandook-0133-found-fcd-dll.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1050315341.img.png/1703003775082/	102 KB 104 KB	42ms 42ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1050315341.img.png/1703003775082/fig05-bandook-0133-found-fcd-dll.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 2013659dd9f07a11220e2a06182d03454734045c770597b17a3e0b567972174e Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 52609 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 104849 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:36:15 GMT Server Apache ETag "19991-60cdf770f5dc0" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id zSWRZMI95JNTQRRLmGAldx7uyGdRn3-QcQJTvmH2-aMdYHamORdNbA==
GET H/1.1	200 OK	fig06-bandook-process-flow-0003-server.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1097496786.img.png/1703003801536/	35 KB 37 KB	43ms 43ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1097496786.img.png/1703003801536/fig06-bandook-process-flow-0003-server.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 5b54fbd94972daaa27b650968b92ffdf3de9fbe62389240656f7b550b33a8db7 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 6fc439c8bc0a64a7ab978ce699795274.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 51833 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 36276 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:36:41 GMT Server Apache ETag "8db4-60cdf789c1840" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id -g_RHBZQZnhR3DyaQfPyb_1cgM2expmbQravJN3A5h6Ydw7D3uSNXQ==
GET H/1.1	200 OK	fig07-bandook-process-flow-0007-server.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_729357284.img.png/1703003824848/	29 KB 30 KB	41ms 41ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_729357284.img.png/1703003824848/fig07-bandook-process-flow-0007-server.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 1f5e55c4511be090aa549285a211959e5caf5f8fe9987ec3a7d5390276668f38 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 2a44338adc8233e5b25aca28287a69c8.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 51965 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 29777 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:37:04 GMT Server Apache ETag "7451-60cdf79fb0c00" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id Mk3_n3uufl73HSDKC0RTIOTy2SNFKV_MZBGanGtUe_kDZUnfSG72aw==
GET H/1.1	200 OK	fig08-bandook-ave-maria-number-sent.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1000005743.img.png/1703003855600/	64 KB 65 KB	43ms 43ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1000005743.img.png/1703003855600/fig08-bandook-ave-maria-number-sent.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 01020da344780c2fb0b39707abda1744bbfe7a6815396c28c27855aa775d81a3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 53759 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 65434 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:37:35 GMT Server Apache ETag "ff9a-60cdf7bd411c0" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id 3p7tjjn4fX2MkqWfpT8AGm6R0iwWTcNBZjNxttBDpv4U0eRS28MLxw==
GET H/1.1	200 OK	fig09-bandook-new-variant-same-function-control-code-and-command.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_913559379.img.png/1703003876714/	77 KB 79 KB	42ms 42ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_913559379.img.png/1703003876714/fig09-bandook-new-variant-same-function-control-code-and-command.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 30296cfda6375fccc0a3d66da97298809a0891b866fb15a96b9c37a64d79c2c7 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 53759 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 79246 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:37:56 GMT Server Apache ETag "1358e-60cdf7d148100" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id iS1azCY7UP2fZD5uGkhqiDu5xx98NFJ0Tu2CN5dtD1xe7Td4FCgt3Q==
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	59 B 304 B	152ms 70ms	XHR application/json	2606:4700:4400::6812:2089 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept application/json Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:23 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS content-type application/json access-control-allow-origin * cf-ray 83f9d85bfdef18f9-FRA access-control-allow-headers Content-Type
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.10.0/	356 KB 78 KB	52ms 52ms	Script application/javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:23 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 Bh9exWOPGIwRshWljrtlEw== age 45488 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 79698 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:43:00 GMT server cloudflare etag 0x8D89735260901BC vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id 28c2f04c-701e-009c-1f7c-eb94e5000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d85c6a1d39da-FRA
GET H2	200	en.json Show response cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/4ee482d4-0cd8-4c59-918a-90483d5b8131/	100 KB 24 KB	60ms 60ms	Fetch application/x-javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/4ee482d4-0cd8-4c59-918a-90483d5b8131/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 46ef912a5bf1fec350dc9d14102bcf1965471f16a57a890bdc5fc06bc4404370 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:23 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 42954 content-md5 0twb7zWjuAt4bYR0sykmNQ== content-length 24175 x-ms-lease-status unlocked last-modified Thu, 28 Dec 2023 19:57:10 GMT server cloudflare etag 0x8DC07DF2D729AA1 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 63201da5-e01e-006a-57c8-39e1ab000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d85cfa1f3620-FRA expires Thu, 04 Jan 2024 08:24:23 GMT
GET H2	200	otCenterRounded.json Show response cdn.cookielaw.org/scripttemplates/6.10.0/assets/	9 KB 3 KB	50ms 50ms	Fetch application/json	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otCenterRounded.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:23 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 SH1nUCPouc1JVrHnvxpQbg== age 75552 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 2857 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:42:51 GMT server cloudflare etag 0x8D89735210A49EB vary Accept-Encoding content-type application/json access-control-allow-origin * x-ms-request-id ee2a9dc1-301e-000b-21e6-1dc2e8000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d85d6a743620-FRA
GET H2	200	otPcTab.json Show response cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/	45 KB 12 KB	51ms 51ms	Fetch application/json	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:23 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 zNsRoM1FEmsEgJoYMCNTng== age 77768 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 11755 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:42:53 GMT server cloudflare etag 0x8D897352245C4EA vary Accept-Encoding content-type application/json access-control-allow-origin * x-ms-request-id 9545b78e-701e-013b-03e1-5adced000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d85d6a763620-FRA
GET H2	200	launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response assets.adobedtm.com/	481 KB 117 KB	133ms 54ms	Script application/x-javascript	2a02:26f0:3500:597::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:597::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 5fc47d28f6738c10fe8546f3fb52b563a929f05b385370165a6655eebea2fa2a Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:24 GMT content-encoding gzip last-modified Fri, 29 Dec 2023 17:29:40 GMT server AkamaiNetStorage etag "ea6dbbbbebcadf61231945009a1c1643:1703870980.947038" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 119627 expires Wed, 03 Jan 2024 09:24:24 GMT
GET H2	200	AppMeasurement.min.js Show response assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/	34 KB 13 KB	57ms 57ms	Script application/x-javascript	2a02:26f0:3500:597::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:597::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 6c789117a5f69b39293256e6899288c8317358589e20c6d08278223f948cd2cf Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:24 GMT content-encoding gzip last-modified Tue, 12 Sep 2023 05:33:26 GMT server AkamaiNetStorage etag "208eb534ea01036a4fca64e6715ccf3f:1694496806.451282" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 12687 expires Wed, 03 Jan 2024 09:24:24 GMT
GET H2	200	AppMeasurement_Module_ActivityMap.min.js Show response assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/	3 KB 2 KB	61ms 61ms	Script application/x-javascript	2a02:26f0:3500:597::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement_Module_ActivityMap.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:597::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash bc0bfc50d3ff4175132b7da1ef0adf7761ded5cb2782e55edb1948da3480abd8 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:24 GMT content-encoding gzip last-modified Tue, 12 Sep 2023 05:33:26 GMT server AkamaiNetStorage etag "f1e098a5dd836ea5fc9726c429c8d71d:1694496806.740373" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 1597 expires Wed, 03 Jan 2024 09:24:24 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	64 KB 17 KB	156ms 40ms	Script application/javascript	23.53.43.58 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-58.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers pragma no-cache date Wed, 03 Jan 2024 08:24:24 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 20 Dec 2023 22:26:49 GMT server nginx/1.14.0 (Ubuntu) etag "65836a29-fee9" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 17567 expires Wed, 03 Jan 2024 08:24:24 GMT
GET H2	200	RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/474bf3ea7133/	358 B 484 B	42ms 42ms	Script application/x-javascript	2a02:26f0:3500:597::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/474bf3ea7133/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:597::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash ff5b07ecbb568fb465a88d1f39cf117d618f0d5a9c7bb41a3154641c2018aa2d Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:24 GMT content-encoding gzip last-modified Fri, 29 Dec 2023 17:29:43 GMT server AkamaiNetStorage etag "e1010308eabed138a5839192538cdb8d:1703870983.942573" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 228 expires Wed, 03 Jan 2024 09:24:24 GMT
GET H2	200	RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/474bf3ea7133/	2 KB 981 B	42ms 41ms	Script application/x-javascript	2a02:26f0:3500:597::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/474bf3ea7133/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:597::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash aa6f4d595eb1617102cbe3538e56decffa61bb72c7713509470b363923413625 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:24 GMT content-encoding gzip last-modified Fri, 29 Dec 2023 17:29:43 GMT server AkamaiNetStorage etag "e1010308eabed138a5839192538cdb8d:1703870983.942573" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 724 expires Wed, 03 Jan 2024 09:24:24 GMT
GET H2	200	optOutStatus Show response dpm.demdex.net/	41 B 542 B	167ms 57ms	XHR application/json	34.240.84.223 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dpm.demdex.net/optOutStatus?d_visid_ver=5.5.0&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1704270264385 Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.240.84.223 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-240-84-223.eu-west-1.compute.amazonaws.com Software / Resource Hash e5873dbdaa376d924cfa4b2ba4b1622d4e6e483866e2b7bc24ef3007ff5960e7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers dcs dcs-prod-irl1-1-v054-097c24447.edge-irl1.demdex.com 3 ms pragma no-cache date Wed, 03 Jan 2024 08:24:24 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-tid 4FBVIW8cQRI= vary Origin content-type application/json;charset=utf-8 p3p policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" access-control-allow-origin https://www.fortinet.com cache-control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private access-control-allow-credentials true content-length 60 expires Thu, 01 Jan 1970 00:00:00 UTC
GET H2	200	/ Show response c.6sc.co/	7 B 194 B	46ms 46ms	XHR text/html	23.53.43.58 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-58.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:24 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.fortinet.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	20 B 311 B	158ms 40ms	XHR text/html	2a02:26f0:ab00::214:8e41 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:ab00::214:8e41 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash bfd3189d965573e36997f170667b1ceef5cfd0471b6f5be228ca6ac7bcb97c23 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers pragma no-cache date Wed, 03 Jan 2024 08:24:24 GMT vary Origin content-type text/html access-control-allow-origin https://www.fortinet.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::12 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1704270264478_34901565_812407545_32_1045_38_79_219";dur=1 content-length 20 expires Wed, 03 Jan 2024 08:24:24 GMT
GET H2	200	s26785124507571 metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/ Redirect Chain https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s26785124507571?AQB=1&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A24%203%20-60&fid=5A6F09BF6CF46659-099FB6D7233B96AB&ce=UTF-8&pageN... https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s26785124507571?AQB=1&pccr=true&vidn=32CA8CDC7825B778-60000728203F849C&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A24%203%20-60&fid...	43 B 249 B	54ms 53ms	Image image/gif	63.140.62.164 OMNITURE
General Check archive.org Show headers Download Go to Show image Full URL https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s26785124507571?AQB=1&pccr=true&vidn=32CA8CDC7825B778-60000728203F849C&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A24%203%20-60&fid=5A6F09BF6CF46659-099FB6D7233B96AB&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 Protocol H2 Server 63.140.62.164 , United States, ASN15224 (OMNITURE, US), Reverse DNS ip-63-140-62-164.data.adobedc.net Software jag / Resource Hash a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers pragma no-cache date Wed, 03 Jan 2024 08:24:24 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Thu, 04 Jan 2024 08:24:24 GMT server jag etag 3659892523923963904-4617851228699706461 vary * p3p CP="This is not a P3P policy" access-control-allow-origin * content-type image/gif;charset=utf-8 cache-control no-cache, no-store, max-age=0, no-transform, private content-length 43 x-xss-protection 1; mode=block expires Tue, 02 Jan 2024 08:24:24 GMT Redirect headers pragma no-cache date Wed, 03 Jan 2024 08:24:24 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Thu, 04 Jan 2024 08:24:24 GMT server jag vary Origin p3p CP="This is not a P3P policy" access-control-allow-origin * location https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s26785124507571?AQB=1&pccr=true&vidn=32CA8CDC7825B778-60000728203F849C&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A24%203%20-60&fid=5A6F09BF6CF46659-099FB6D7233B96AB&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 content-type text/plain;charset=utf-8 cache-control no-cache, no-store, max-age=0, no-transform, private content-length 0 x-xss-protection 1; mode=block expires Tue, 02 Jan 2024 08:24:24 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	726 B 674 B	125ms 45ms	XHR application/json	18.184.137.169 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.184.137.169 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-184-137-169.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 4af0af54f335975e4e3c704829ee7882427fd49a71b43206306e8c84949a7b73 Request headers Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 Authorization Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 X-6s-CustomID WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36 Response headers date Wed, 03 Jan 2024 08:24:24 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json x-6si-region eu-central-1a access-control-allow-origin https://www.fortinet.com access-control-expose-headers X-6si-Region access-control-allow-credentials true timing-allow-origin https://6sense.com, https://www.ssga.com content-length 389
OPTIONS H2	200	details epsilon.6sense.com/v3/company/	0 0	125ms 42ms	Preflight	18.184.137.169 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.184.137.169 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-184-137-169.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.fortinet.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.fortinet.com access-control-expose-headers X-6si-Region access-control-max-age 1800 date Wed, 03 Jan 2024 08:24:24 GMT server nginx timing-allow-origin https://6sense.com, https://www.ssga.com x-6si-region eu-central-1a