www.fortinet.com Open in urlscan Pro
52.52.208.2 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Submission: On November 17 via api (November 17th 2019, 12:17:49 am UTC) from DE

Summary HTTP 49 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 24 IPs in 5 countries across 22 domains to perform 49 HTTP transactions. The main IP is 52.52.208.2, located in San Jose, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on January 22nd 2019. Valid for: 2 years.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
11	52.52.208.2 52.52.208.2	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	2.18.232.23 2.18.232.23	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
1 3	3.248.26.129 3.248.26.129	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	2.21.36.164 2.21.36.164	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	34.253.43.81 34.253.43.81	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	15.188.31.119 15.188.31.119	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
1 4	2.18.233.40 2.18.233.40	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2a02:26f0:6c0... 2a02:26f0:6c00:2bf::3adf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.111.9.217 23.111.9.217	33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
1 1	2a05:f500:11:... 2a05:f500:11:101::b93f:9001	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
2	50.17.52.222 50.17.52.222	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	52.209.38.145 52.209.38.145	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a00:1450:400... 2a00:1450:4001:81a::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	54.231.50.58 54.231.50.58	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a02:26f0:6c0... 2a02:26f0:6c00:296::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY - Fastly)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER - Twitter Inc.)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER - Twitter Inc.)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
49	24

11 52.52.208.2 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-52-208-2.us-west-1.compute.amazonaws.com

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2.18.232.23 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-23.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.248.26.129 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-248-26-129.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.21.36.164 (France)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-36-164.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.253.43.81 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-253-43-81.eu-west-1.compute.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.188.31.119 (Paris, France)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE - Adobe Systems Inc., US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.18.233.40 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-40.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:2bf::3adf (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.9.217 (Phoenix, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)

a.optmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:11:101::b93f:9001 (Ireland) 1 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.17.52.222 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-50-17-52-222.compute-1.amazonaws.com

api.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.209.38.145 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-209-38-145.eu-west-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.231.50.58 (Ashburn, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-1-w.amazonaws.com

optin-monster.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:296::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER - Twitter Inc., US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER - Twitter Inc., US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	fortinet.com www.fortinet.com metrics.fortinet.com	551 KB
6	adroll.com 1 redirects s.adroll.com d.adroll.com	38 KB
6	adobedtm.com assets.adobedtm.com	65 KB
4	demdex.net 1 redirects dpm.demdex.net fortinet.demdex.net	3 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	2 KB
2	facebook.com www.facebook.com	449 B
2	facebook.net connect.facebook.net	113 KB
2	opmnstr.com api.opmnstr.com app.opmnstr.com	102 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	addthis.com s7.addthis.com	189 KB
1	t.co t.co	448 B
1	twitter.com analytics.twitter.com	636 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	licdn.com snap.licdn.com	2 KB
1	amazonaws.com optin-monster.s3.amazonaws.com	76 KB
1	googleapis.com ajax.googleapis.com	7 KB
1	optmnstr.com a.optmnstr.com	58 KB
1	bizographics.com sjs.bizographics.com	2 KB
1	addthisedge.com v1.addthisedge.com	826 B
1	everesttech.net 1 redirects cm.everesttech.net	527 B
1	moatads.com z.moatads.com	1 KB
1	googletagmanager.com www.googletagmanager.com	25 KB
49	22

	Domain	Requested by
11	www.fortinet.com	www.fortinet.com
6	assets.adobedtm.com	www.fortinet.com assets.adobedtm.com
4	s.adroll.com	1 redirects www.googletagmanager.com www.fortinet.com s.adroll.com
3	dpm.demdex.net	1 redirects www.fortinet.com
2	www.facebook.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	d.adroll.com	s.adroll.com www.fortinet.com
2	px.ads.linkedin.com	1 redirects www.fortinet.com
2	metrics.fortinet.com	assets.adobedtm.com www.fortinet.com
2	www.google-analytics.com	www.googletagmanager.com www.fortinet.com
2	s7.addthis.com	assets.adobedtm.com s7.addthis.com
1	t.co
1	analytics.twitter.com	static.ads-twitter.com
1	static.ads-twitter.com	www.fortinet.com
1	snap.licdn.com	www.fortinet.com
1	optin-monster.s3.amazonaws.com	www.fortinet.com
1	ajax.googleapis.com	a.optmnstr.com
1	app.opmnstr.com	a.optmnstr.com
1	api.opmnstr.com	a.optmnstr.com
1	www.linkedin.com	1 redirects
1	a.optmnstr.com	www.googletagmanager.com
1	sjs.bizographics.com	www.googletagmanager.com
1	v1.addthisedge.com	s7.addthis.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	assets.adobedtm.com
1	z.moatads.com	s7.addthis.com
1	www.googletagmanager.com	www.fortinet.com
49	27

This site contains links to these domains. Also see Links.

Domain
www.virustotal.com
www.facebook.com
www.twitter.com
www.youtube.com
www.linkedin.com
www.instagram.com
fortiguard.com
secure.fortinet.com
fusecommunity.fortinet.com
cookie-script.com
www.addthis.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-22` - `2021-03-31`	2 years	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
odc-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2020-09-04`	a year	crt.sh
moatads.com DigiCert ECC Secure Server CA	`2018-11-10` - `2020-02-09`	a year	crt.sh
metrics.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-29` - `2021-02-02`	2 years	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2018-12-19` - `2020-03-19`	a year	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2018-04-13` - `2020-04-17`	2 years	crt.sh
*.optmnstr.com Go Daddy Secure Certificate Authority - G2	`2018-07-10` - `2020-07-10`	2 years	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2019-05-29` - `2021-06-29`	2 years	crt.sh
*.opmnstr.com Go Daddy Secure Certificate Authority - G2	`2019-04-11` - `2021-04-11`	2 years	crt.sh
adroll.mgr.consensu.org Amazon	`2019-11-06` - `2020-12-06`	a year	crt.sh
*.googleapis.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2019-11-09` - `2021-03-12`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-11-06` - `2020-02-04`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Frame ID: ADA3A212C84FD72DF44BB655482B7E8D
Requests: 52 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 76DF04EBB2437BB6FB7F0A6991ED072D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /(?:a|s)\.adroll\.com/i

Adobe DTM (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/assets.adobedtm.com\//i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Page Statistics

49
Requests

100 %
HTTPS

36 %
IPv6

22
Domains

27
Subdomains

24
IPs

5
Countries

1252 kB
Transfer

3503 kB
Size

16
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.virustotal.com/gui/file/35c0980e99987f4418c8d186b9d5514c340c05ec0470c485182d24868f2a37db/detection
Title: sample

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/SecureNetworks
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/behindthefirewall/
Title:

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://secure.fortinet.com/fortiguard
Title: Threat Briefs

Search URL Search Domain Scan URL

URL: https://fusecommunity.fortinet.com/
Title: Fuse

Search URL Search Domain Scan URL

URL: https://cookie-script.com/
Title: Free cookie consent by cookie-script.com

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://dpm.demdex.net/id?d_visid_ver=4.4.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1573949852379 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1573949852379

Request Chain 18

https://cm.everesttech.net/cm/dd?d_uuid=80593566327356294242577211931281077469 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XdCRnAAAFZtHOhKk

Request Chain 29

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 30

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&time=1573949852707 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fmalware-analysis-revenge-rat-sample.html%26time%3D1573949852707%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&time=1573949852707&liSync=true

49 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set malware-analysis-revenge-rat-sample.html Show response
www.fortinet.com/blog/threat-research/ 74 KB
20 KB 508ms
172ms Document
text/html 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

41a007ff94447dbf16c92fea8d347a9468347c6663a344d3a39051a3b9d88cf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.fortinet.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=600, public
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Sun, 17 Nov 2019 00:17:31 GMT
ETag: "1260f-597696004b852-gzip"
Last-Modified: Fri, 15 Nov 2019 21:35:21 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
Content-Length: 19725
Connection: keep-alive
Set-Cookie: cookiesession1=1B68D093BOFI5T0SPLM0BYVED0H45166;Path=/;HttpOnly

GET
H/1.1 200
OK clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 212 KB
25 KB 249ms
167ms Stylesheet
text/css 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

a6e773c3cab0651d5e692012a6e9b5df64ea5374e8c4dc338d99fc5131d89aad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Sun, 17 Nov 2019 00:17:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 25 Oct 2019 21:32:50 GMT
Server: Apache
ETag: "35136-595c2e44d0480-gzip"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Content-Type: text/css;charset=utf-8
Cache-Control: max-age=43200, public
Connection: keep-alive
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Length: 25628

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 186 KB
49 KB 20ms
6ms Script
application/x-javascript 2.18.232.23
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-23.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: dc8cc75354634f56b7fdcdda16ff8c17ea574432ae8d2153d04d8f347302281d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:32 GMT
content-encoding: gzip
last-modified: Fri, 15 Nov 2019 23:49:24 GMT
server: AkamaiNetStorage
etag: "9aefa3c3d151578b79a053c092d45b8c:1573861764.130623"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 49570
expires: Sun, 17 Nov 2019 01:17:32 GMT

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
2 KB 496ms
171ms Image
image/svg+xml 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Sun, 17 Nov 2019 00:17:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Connection: keep-alive
Content-Length: 1998
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "7ebb-565d53a1d6e40-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Accept-Ranges: bytes

GET
H/1.1 200
OK clientlib-base.min.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 165 KB
75 KB 345ms
178ms Script
application/javascript 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

ad979cd8209daf4934baefa31ec4dede21ae9cc233cf809da2ed5ed839f03a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Sun, 17 Nov 2019 00:17:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 23 Sep 2019 20:57:02 GMT
Server: Apache
ETag: "29256-5933ea9592380-gzip"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript;charset=utf-8
Cache-Control: max-age=43200, public
Connection: keep-alive
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
content-length: 76083

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 66 KB
25 KB 43ms
43ms Script
application/javascript 2a00:1450:4001:806::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2a00c671b83cdd0986f7aa3f2817a9e19371ea991bb869b0edb60b1edecc7ced

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:32 GMT
content-encoding: br
last-modified: Sun, 17 Nov 2019 00:00:00 GMT
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25094
x-xss-protection: 0
expires: Sun, 17 Nov 2019 00:17:32 GMT

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK revengerat-one.png
www.fortinet.com/content/dam/fortinet-blog/article-images/revenge-rat/ 54 KB
55 KB 241ms
174ms Image
image/png 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/revenge-rat/revengerat-one.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

c7c2a637412317b9e13fd52b5ecff08eb1b5da60b3d66a2a5b8eff7eec182a84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Sun, 17 Nov 2019 00:17:32 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 12 Nov 2019 23:44:45 GMT
Server: Apache
ETag: "d92b-5972ed5371540"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 55595

GET
H/1.1 200
OK microsoft-vuln-three.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/bluekeep-vulnerability/ 20 KB
21 KB 301ms
168ms Image
image/png 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/bluekeep-vulnerability/microsoft-vuln-three.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

b2a69f81002746fb20a34679b10c764c2d5f664de10944230824289d55c38348

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Sun, 17 Nov 2019 00:17:32 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Jun 2019 22:25:37 GMT
Server: Apache
ETag: "51ca-58affa8cf3a40"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20938

GET
H/1.1 200
OK tlr-quarter-one.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/threat-landscape-report-q1/ 130 KB
130 KB 396ms
166ms Image
image/png 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/threat-landscape-report-q1/tlr-quarter-one.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

5d7fda52442588c5ae334e48512e3bab1c0a34ed25a9c8ec0c8afe15df3f51d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Sun, 17 Nov 2019 00:17:32 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 17 May 2019 22:40:41 GMT
Server: Apache
ETag: "206f7-5891d12802c40"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 132855

GET
H/1.1 200
OK woocommerce-one.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/woo-commerce-blog/ 38 KB
38 KB 488ms
170ms Image
image/png 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/woo-commerce-blog/woocommerce-one.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

87b784071fc3dd6fbe9f0ed8362565d37f3d3eadc97acfda6ec9b9f628ff076f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Sun, 17 Nov 2019 00:17:32 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 01 Mar 2019 23:10:40 GMT
Server: Apache
ETag: "9731-5831083f2dc00"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 38705

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.4.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1573949852379
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1573949852379

367 B
1 KB

35ms
35ms

XHR
application/json

3.248.26.129
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.4.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1573949852379

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.248.26.129 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-3-248-26-129.eu-west-1.compute.amazonaws.com

Software

Resource Hash

00b888da67704409cbd106c2141c36adc836e1a4f35510f029cd77d9c1397335

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v054-0c89034a9.edge-irl1.demdex.com 5.63.0.20191112162344 3ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: M7s3wtEfRwk=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.fortinet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 301
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://www.fortinet.com
X-TID: UlzNhK23TOk=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=4.4.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1573949852379
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP6580734006504e9facd682c439318b88/ 36 KB
13 KB 6ms
6ms Script
application/x-javascript 2.18.232.23
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP6580734006504e9facd682c439318b88/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-23.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b688b7d8c9a306ac5fc64ab06561ca04693e1c5d0ea9877a4c853581d04971ea

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:32 GMT
content-encoding: gzip
last-modified: Mon, 09 Sep 2019 22:19:26 GMT
server: AkamaiNetStorage
etag: "279821f231e2e055aa15fd6e6ae29d46:1568067566.281876"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 13336
expires: Sun, 17 Nov 2019 01:17:32 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 349 KB
113 KB 26ms
10ms Script
application/javascript 2.21.36.164
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-164.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

7c20e3e201e3d7c6821e907def1257deb544eb08578c7129b96d53bbf62d34e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Wed, 30 Oct 2019 19:35:04 GMT
server: nginx/1.15.8
etag: "5db9e5e8-57446"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Sun, 17 Nov 2019 00:17:32 GMT
x-host: s7.addthis.com
content-length: 114924

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 6235
date: Sat, 16 Nov 2019 22:33:37 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Sun, 17 Nov 2019 00:33:37 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
111 B 13ms
13ms Image
image/gif 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1112596020&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&ul=en-us&de=UTF-8&dt=Double%20Trouble%3A%20RevengeRAT%20and%20WSHRAT&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAAAB~&jid=1407478005&gjid=1327116989&cid=972752953.1573949852&tid=UA-767980-6&_gid=1643663927.1573949852&_r=1&gtm=2wgav3NBSLLPJ&z=826889859

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Nov 2019 00:17:32 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 24ms
6ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 17 Nov 2019 00:17:32 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 Nov 2019 20:13:52 GMT
Server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
ETag: "f14b4e1f799b14f798a195f43cf58376"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=58886
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H/1.1 200
OK Cookie set dest5.html
fortinet.demdex.net/ Frame 76DF 0
0 119ms
29ms Document
text/html 34.253.43.81
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.253.43.81 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-34-253-43-81.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: fortinet.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Accept-Encoding: gzip, deflate, br
Cookie: demdex=80593566327356294242577211931281077469
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 14 Nov 2019 13:27:23 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=80593566327356294242577211931281077469;Path=/;Domain=.demdex.net;Expires=Fri, 15-May-2020 00:17:32 GMT;Max-Age=15552000
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: qu9VX2PuSGw=
Content-Length: 2764
Connection: keep-alive

GET
H2 200 id Show response
metrics.fortinet.com/ 49 B
472 B 62ms
14ms XHR
application/x-javascript 15.188.31.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.fortinet.com/id?d_visid_ver=4.4.1&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=80250497072926151602540657462336951637&ts=1573949852544

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a3e7bb0d5bab6ff5e495c935cd71ced832381bda643962a4db9c9a86ad9f04ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Sun, 17 Nov 2019 00:17:32 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-5fc496b8d4-zfbkc
vary: Origin
x-c: master-1061.Iecc33a.M0-311
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript
content-length: 49
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=XdCRnAAAFZtHOhKk
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=80593566327356294242577211931281077469
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XdCRnAAAFZtHOhKk

42 B
873 B

32ms
32ms

Image
image/gif

3.248.26.129
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=XdCRnAAAFZtHOhKk

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.248.26.129 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-3-248-26-129.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v054-0dbf417fa.edge-irl1.demdex.com 5.63.0.20191112162344 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: B7RLrh2nTQQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Sun, 17 Nov 2019 00:17:31 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=XdCRnAAAFZtHOhKk
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 s6755612039893
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.17.0-L9UP/ 43 B
221 B 14ms
14ms Image
image/gif 15.188.31.119
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.17.0-L9UP/s6755612039893?AQB=1&ndh=1&pf=1&t=17%2F10%2F2019%201%3A17%3A32%200%20-60&mid=80250497072926151602540657462336951637&aamlh=6&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Amalware-analysis-revenge-rat-sample&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&cc=USD&events=event3&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&v3=%2B1&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Amalware-analysis-revenge-rat-sample&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:32 GMT
x-content-type-options: nosniff
x-c: master-1061.Iecc33a.M0-311
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Mon, 18 Nov 2019 00:17:32 GMT
server: jag
xserver: anedge-5fc496b8d4-bn56n
etag: 3380031570027315200-4617574918468324992
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Sat, 16 Nov 2019 00:17:32 GMT

GET
H2 200 RCb652faf409a54c3db318899e2cbcc95c-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/fcf0c43faa5c/ 881 B
697 B 6ms
6ms Script
application/x-javascript 2.18.232.23
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/fcf0c43faa5c/RCb652faf409a54c3db318899e2cbcc95c-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-23.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4e5c000d359e18e247429110f46545e27220c168981dc3f1f3fa9b0de2474aa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:32 GMT
content-encoding: gzip
last-modified: Fri, 15 Nov 2019 23:49:25 GMT
server: AkamaiNetStorage
etag: "c87b8b26abecd065d35a055dba50c356:1573861765.357849"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 451
expires: Sun, 17 Nov 2019 01:17:32 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/ 2 KB
826 B 119ms
117ms Script
application/javascript 2.21.36.164
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-21-36-164.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.8.v20180619) /
Resource Hash: 133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:32 GMT
content-encoding: gzip
surrogate-key: ra-5d48adfc650f1a9e
server: Jetty(9.4.8.v20180619)
cache-tag: ra-5d48adfc650f1a9e
etag: 1861047380--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=56, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 580

GET
H/1.1 200
OK revengerat-one.png
www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample/_jcr_content/root/responsivegrid/image_1337821993.img.png/1573604360030/ 43 KB
43 KB 163ms
162ms Image
image/png 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample/_jcr_content/root/responsivegrid/image_1337821993.img.png/1573604360030/revengerat-one.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

a358cd07b58872d844f9c1bbca1e9313ff187464b900e4de3be0518d4f69568f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Sun, 17 Nov 2019 00:17:32 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 13 Nov 2019 00:19:20 GMT
Server: Apache
ETag: "ac04-5972f50e51200"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 44036

GET
H/1.1 200
OK revengerat-two.png
www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample/_jcr_content/root/responsivegrid/image_1779882811.img.png/1573604391748/ 48 KB
49 KB 169ms
169ms Image
image/png 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample/_jcr_content/root/responsivegrid/image_1779882811.img.png/1573604391748/revengerat-two.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d223439f0a00d264eadf96d43a5245e291ff1504db055176eb8a3da4ef532cb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Sun, 17 Nov 2019 00:17:32 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 13 Nov 2019 00:19:51 GMT
Server: Apache
ETag: "c12b-5972f52be17c0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 49451

GET
H/1.1 200
OK revengerat-three.png
www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample/_jcr_content/root/responsivegrid/image_1095175056.img.png/1573604417171/ 91 KB
92 KB 265ms
161ms Image
image/png 52.52.208.2
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample/_jcr_content/root/responsivegrid/image_1095175056.img.png/1573604417171/revengerat-three.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d6df1bca3f52fafa22d16bb86bc71723212b30401ea887f94635bb855b2e4ca4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Sun, 17 Nov 2019 00:17:32 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 13 Nov 2019 00:20:17 GMT
Server: Apache
ETag: "16dc2-5972f544ad240"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 93634

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 35 KB
12 KB 7ms
7ms Script
text/javascript 2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 9a1feb90b6ffeec42d4f7c25ddf2128b404907e8b3503590f4877b0c3f57b30d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: eGid0unkuM.sMGI9ZEANomX0UqKXsID9
Content-Encoding: gzip
ETag: "cb131b040b408f4bdaf47bd39b4f22cc"
x-amz-request-id: E3366801F176C9CC
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 11264
x-amz-id-2: 0fxGKZtAdJqhjhvQ+bCnP2F1q8M6fpJTS3CUPbhp8gPT3cZdp0cnAIA9rSdwchZFqZl8VvwMQmM=
Last-Modified: Wed, 13 Nov 2019 22:23:44 GMT
Server: AmazonS3
Date: Sun, 17 Nov 2019 00:17:32 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 3 KB
2 KB 19ms
6ms Script
application/x-javascript 2a02:26f0:6c00:2bf::3adf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:2bf::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 17 Nov 2019 00:17:32 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=33711
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 api.min.js Show response
a.optmnstr.com/app/js/ 194 KB
58 KB 26ms
6ms Script
application/javascript 23.111.9.217
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://a.optmnstr.com/app/js/api.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 44bcb425701b97b61a4f915834222632c9fc341437599d9491dd3707d1f1193c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:32 GMT
content-encoding: gzip
last-modified: Fri, 01 Nov 2019 17:05:39 GMT
server: NetDNA-cache/2.2
x-amz-request-id: FC6AFA92993550B3
etag: W/"ff6208bca40c53f2ac27ad7518894ce5"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=2592000
access-control-allow-origin: *
x-amz-id-2: gYjyC2MUqNZIkiU/U5oTsQHbouQcc3tnAJt+L4TaC0lbIJMVQmO0Dq3yyMKFsrB7d6gc6FQPuy4=
expires: Tue, 17 Dec 2019 00:17:32 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js
https://s.adroll.com/j/exp/index.js

28 B
680 B

6ms
6ms

Script
application/javascript

2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: OUZwgMsrX2CE2SdKfg6EPbcCzOsxj06E
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: EA14AF4FC529B4CB
x-amz-server-side-encryption: AES256
Connection: keep-alive
Content-Length: 28
x-amz-id-2: OSsnRO5mN8jo5d+De05pS6KSajuIAkz+pedESPHRECU9s/6zMeDlU5rtrGzyt77dkVr0fRRdfWI=
Last-Modified: Thu, 14 Nov 2019 22:49:12 GMT
Server: AmazonS3
Date: Sun, 17 Nov 2019 00:17:32 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Sun, 17 Nov 2019 00:17:32 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&time=1573949852707
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%25...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&time=1573949852707&liSync=true

0
110 B

166ms
165ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LinkedIn Corporation

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&time=1573949852707&liSync=true
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:33 GMT
content-encoding: gzip
server: Play
vary: Accept-Encoding
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 20
x-li-uuid: MEUuYg3L1xWApW0QaSsAAA==

Redirect headers

date: Sun, 17 Nov 2019 00:17:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 302
vary: Accept-Encoding
content-length: 20
x-li-uuid: NHxeWA3L1xWQSEty1ioAAA==
server: Play
pragma: no-cache
x-li-pop: prod-tln1
x-frame-options: sameorigin
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&time=1573949852707&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 39852 Show response
api.opmnstr.com/v2/embed/ 661 KB
101 KB 345ms
172ms XHR
application/json 50.17.52.222
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.opmnstr.com/v2/embed/39852
Requested by: Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.17.52.222 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-50-17-52-222.compute-1.amazonaws.com
Software: Pagely Gateway/1.5.1 /
Resource Hash: a2a5d9a9c7bbd63fcbdad20df962b687d8d228dbbcbc5b10128b7490e0555128

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-user-agent: standard
content-encoding: gzip
x-cache-config: 0 0
server: Pagely Gateway/1.5.1
status: 200
date: Sun, 17 Nov 2019 00:17:32 GMT
x-cache-status: HIT
vary: Accept-Encoding, User-Agent
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-OptinMonster-Account
access-control-allow-headers: X-CSRF-Token
x-optinmonster-account: 45602

GET
H2 200 layers.ab5cd98fe1b9a38a4a9f.js Show response
s7.addthis.com/static/ 263 KB
76 KB 10ms
10ms Script
application/javascript 2.21.36.164
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-36-164.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Wed, 18 Sep 2019 14:16:17 GMT
server: nginx/1.15.8
etag: W/"5d823c31-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Sun, 17 Nov 2019 00:17:32 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77528

GET
H2 200 7OBVBCAQE5FHDPFEAD5T4D Show response
d.adroll.com/consent/check/ 88 B
179 B 98ms
31ms Script
application/javascript 52.209.38.145
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D?_s=520ac0d91603e25b64710361a72189df&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.38.145 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-209-38-145.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 219ab0ad68af94a75770c2d8404433b3ca47fd6bf900464b058f50c21ed87854

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Sun, 17 Nov 2019 00:17:32 GMT
server: nginx/1.16.1
content-length: 88
content-type: application/javascript

GET
H/1.1 200
OK consent.js Show response
s.adroll.com/j/ 177 KB
25 KB 11ms
11ms Script
application/javascript 2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a9deb521436ad37051d51543f2445bb999ddb6f459da1c6165e155aa99e0c4f0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: mUP7jw_OqQybVflhPbyIiIDmhEvIvOlK
Content-Encoding: gzip
ETag: "e2416a8dda91db724f94f8cf899ec942"
x-amz-request-id: 271B5C1684C2E517
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 25154
x-amz-id-2: bSbj3I+cDjCTdjGZCaQFdJ782xsgHhEwfa32wY58mLwyUUv2Wo2wYtrpVPr+oM7SMvtdpaHYbxI=
Last-Modified: Mon, 30 Sep 2019 18:10:17 GMT
Server: AmazonS3
Date: Sun, 17 Nov 2019 00:17:32 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2 200 hod
d.adroll.com/consent/ 42 B
180 B 30ms
29ms Image
image/gif 52.209.38.145
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/consent/hod?_e=view_banner&_s=520ac0d91603e25b64710361a72189df&_b=2&_a=7OBVBCAQE5FHDPFEAD5T4D
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.38.145 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-209-38-145.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Sun, 17 Nov 2019 00:17:33 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.16.1
content-length: 42
vary: Cookie
content-type: image/gif

GET
H2 200 / Show response
app.opmnstr.com/v2/geolocate/json/ 206 B
520 B 96ms
87ms XHR
application/json 50.17.52.222
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://app.opmnstr.com/v2/geolocate/json/
Requested by: Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.17.52.222 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-50-17-52-222.compute-1.amazonaws.com
Software: Pagely Gateway/1.5.1 /
Resource Hash: a4466c46018393536d0044282263d56cedfedbadfa2c897d84c7c2a19770cb60

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-user-agent: standard
x-cache-config: 0 0
server: Pagely Gateway/1.5.1
status: 200
date: Sun, 17 Nov 2019 00:17:33 GMT
x-cache-status: BYPASS
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.fortinet.com
x-ratelimit-remaining: 999
access-control-allow-credentials: true
x-ratelimit-reset: 1573949913
x-ratelimit-limit: 1000
x-database-date: Mon, 11 Nov 2019 18:36:13 GMT
content-length: 206

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.5.18/ 16 KB
7 KB 19ms
5ms Script
text/javascript 2a00:1450:4001:81a::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Requested by

Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 12 Nov 2019 11:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 392919
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6490
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Nov 2020 11:08:54 GMT

GET
H/1.1 200
OK 7311866092b21573653939-blog-banner-1024x160-TLR-Q3-2019-1.jpg
optin-monster.s3.amazonaws.com/users/df0603609574/images/ 76 KB
76 KB 375ms
112ms Image
image/jpeg 54.231.50.58
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optin-monster.s3.amazonaws.com/users/df0603609574/images/7311866092b21573653939-blog-banner-1024x160-TLR-Q3-2019-1.jpg
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.231.50.58 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6fe342c41e356ff16a92c7c97f47edbd0233227c1ec0dbc73b5e1bcb4f2f100d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 17 Nov 2019 00:17:34 GMT
x-amz-request-id: 196D90CE270AE522
x-amz-meta-date: 1573653939
Content-Length: 77565
x-amz-id-2: UkzOQcucZxDFPmYQ8PGPdGl8bxhxt6uY2pHKjo+Iwvn0nZUeBCCqNpWFiaAeI3e98VgOs9cnwho=
x-amz-meta-level: pro
x-amz-meta-dimensions: 1024 x 160
Last-Modified: Wed, 13 Nov 2019 14:05:40 GMT
Server: AmazonS3
x-amz-meta-accountid: 45602
ETag: "b6c9a422a9e4b1b707ad3fc36fc24b2d"
Content-Type: image/jpeg
x-amz-meta-userid: 39852
x-amz-meta-title: 7311866092b21573653939-blog-banner-1024x160-TLR-Q3-2019-1.jpg
Cache-Control: 31104000
Accept-Ranges: bytes
Expires: Fri, 13 Nov 2020 14:05:39 GMT

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dbeeb3fa5f0188835b6b6208bc89d641f030e79e27ad5712d427eabd79e6095a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 RC0b6c219cefad47a7856f990eee551ad6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/fcf0c43faa5c/ 847 B
722 B 6ms
5ms Script
application/x-javascript 2.18.232.23
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/fcf0c43faa5c/RC0b6c219cefad47a7856f990eee551ad6-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-23.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bc84d9c6d37dd32ee96c55a4c840ed6205a8a36bb8fb999b2a92624704bea13

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:33 GMT
content-encoding: gzip
last-modified: Fri, 15 Nov 2019 23:49:25 GMT
server: AkamaiNetStorage
etag: "c87b8b26abecd065d35a055dba50c356:1573861765.357849"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 476
expires: Sun, 17 Nov 2019 01:17:33 GMT

GET
H2 200 RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/fcf0c43faa5c/ 819 B
746 B 6ms
6ms Script
application/x-javascript 2.18.232.23
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/fcf0c43faa5c/RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-23.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 505fea47d9c532beedcc1ac2447c7d3a157e8a68af7b27a9cf0ff711387bfc6d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:33 GMT
content-encoding: gzip
last-modified: Fri, 15 Nov 2019 23:49:25 GMT
server: AkamaiNetStorage
etag: "c87b8b26abecd065d35a055dba50c356:1573861765.357849"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 501
expires: Sun, 17 Nov 2019 01:17:33 GMT

GET
H2 200 RC4da2046cb6a74ff89eee84fdeadc51af-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/fcf0c43faa5c/ 1005 B
834 B 6ms
6ms Script
application/x-javascript 2.18.232.23
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/fcf0c43faa5c/RC4da2046cb6a74ff89eee84fdeadc51af-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-23.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 56118c393aa7a8837f61993f2a1b16fcb0f83f77cf63aa3bad72d84599e8ff7d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:33 GMT
content-encoding: gzip
last-modified: Fri, 15 Nov 2019 23:49:25 GMT
server: AkamaiNetStorage
etag: "c87b8b26abecd065d35a055dba50c356:1573861765.357849"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 588
expires: Sun, 17 Nov 2019 01:17:33 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 20ms
6ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 17 Nov 2019 00:17:33 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=16660
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 20ms
5ms Script
application/javascript 151.101.112.157
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:33 GMT
content-encoding: gzip
age: 57870
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-hhn4021-HHN
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1573949854.919160,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 122 KB
27 KB 16ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

1d0194204c2d3c2f02e0dd61ac75a7db82bf71749b8f9947adaf9145c26ba6ab

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-23=":443"; ma=3600
content-length: 27344
x-xss-protection: 0
pragma: public
x-fb-debug: PRnx+17sQkLux2AeV4b3quzwy78MSPztbhHjq0mMX6plO5UhLWvRDoMcm/PKwvrvThkFLUtwNR7Zk+Zfp98aag==
x-fb-trip-id: 420120009
x-frame-options: DENY
date: Sun, 17 Nov 2019 00:17:33 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
636 B 140ms
125ms Script
application/javascript 104.244.42.195
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Sun, 17 Nov 2019 00:17:34 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 7a6fd804d7032f28afa403e41c1fc997
x-transaction: 0037445d009f1a80
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 139ms
124ms Image
image/gif 104.244.42.197
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Sun, 17 Nov 2019 00:17:34 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 92826c42d94bf1f65c605cbafe26e777
x-transaction: 0092cc65000886d3
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 559328277756725 Show response
connect.facebook.net/signals/config/ 348 KB
85 KB 64ms
64ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/559328277756725?v=2.9.11&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

02c46e0e185d5b8e80f549dcbf3ce265cc5f1c77c2fdeb426035a47a52307bf0

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-23=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: eNpUBPa37y2hhadL3INZi9cQ64bdY8F9kgP9nnGigoAVJtPli1B5w+7Ix/wxCUUhFTaHuJXOjbro2f1GQWa2UQ==
x-fb-trip-id: 420120009
x-frame-options: DENY
date: Sun, 17 Nov 2019 00:17:33 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
349 B 17ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=559328277756725&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&rl=&if=false&ts=1573949854044&sw=1600&sh=1200&v=2.9.11&r=stable&ec=0&o=30&fbp=fb.1.1573949854043.1947944671&it=1573949853931&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:34 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-23=":443"; ma=3600
content-length: 44
expires: Sun, 17 Nov 2019 00:17:34 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
100 B 6ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=559328277756725&ev=Microdata&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html&rl=&if=false&ts=1573949854547&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Double%20Trouble%3A%20%20RevengeRAT%20and%20WSHRAT%22%2C%22meta%3Akeywords%22%3A%22threat%20research%2CThreat%20Research%2Cmalware%20analysis%2CCybersecurity%20Architect%22%2C%22meta%3Adescription%22%3A%22Learn%20more%20about%20a%20new%20Revenge%20RAT%20sample%20recently%20captured%20in%20the%20wild%20by%20our%20FortiGuard%20Labs%20team.%20%22%7D&cd[OpenGraph]=%7B%22og%3Asite_name%22%3A%22Fortinet%20Blog%22%2C%22og%3Atitle%22%3A%22Double%20Trouble%3A%20%20RevengeRAT%20and%20WSHRAT%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Adescription%22%3A%22Learn%20more%20about%20a%20new%20Revenge%20RAT%20sample%20recently%20captured%20in%20the%20wild%20by%20our%20FortiGuard%20Labs%20team.%20%E2%80%A6%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.fortinet.com%2Fcontent%2Fdam%2Ffortinet-blog%2Farticle-images%2Frevenge-rat%2Frevengerat-one.png%22%2C%22twitter%3Acard%22%3A%22summary%22%2C%22twitter%3Asite%22%3A%22%40Fortinet%22%2C%22article%3Aauthor%22%3A%22Chris%20Navarrete%20and%20Xiaopeng%20Zhang%22%2C%22article%3Asection%22%3A%22Threat%20Research%22%2C%22article%3Apublished_time%22%3A%222019-11-13T00%3A00%3A00.000-08%3A00%22%2C%22article%3Atag%22%3A%22Cybersecurity%20Architect%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.11&r=stable&ec=1&o=30&fbp=fb.1.1573949854043.1947944671&it=1573949853931&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 Nov 2019 00:17:34 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-23=":443"; ma=3600
content-length: 44
expires: Sun, 17 Nov 2019 00:17:34 GMT

Verdicts & Comments Add Verdict or Comment

171 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-23 05:11:03	Name: _omappvp Value: JMDp5eAZNJpqudje5ytefdqXWlqMg2rpvxTdQkWcm2NMVLMhvnmEE2uzIn0h6qt1vcI1Y3b9f3wWz01avjmZ2IJ5Rv0F8XOr
www.fortinet.com/	1970-01-19 05:55:41	Name: omSeen-qxx1b0gslklfu2kjckea Value: 1573949853877
.fortinet.com/	1970-01-19 22:45:08	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 1075005958%7CMCIDTS%7C18218%7CMCMID%7C80250497072926151602540657462336951637%7CMCAAMLH-1574554652%7C6%7CMCAAMB-1574554652%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1573957052s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18225%7CvVersion%7C4.4.1
www.fortinet.com/	1970-01-19 14:42:44	Name: __atuvc Value: 1%7C47
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.fortinet.com/	1970-01-19 22:43:41	Name: s_ecid Value: MCMID%7C80250497072926151602540657462336951637
.fortinet.com/	1970-01-19 05:12:31	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html
.demdex.net/	1970-01-19 09:31:41	Name: demdex Value: 80593566327356294242577211931281077469
.fortinet.com/	1970-01-19 07:22:05	Name: s_getNewRepeat Value: 1573949852619-New
www.fortinet.com/	1970-01-19 05:12:30	Name: _omappvs Value: 1573949852730
www.fortinet.com/	1969-12-31 23:59:59	Name: cookiesession1 Value: 1B68D093BOFI5T0SPLM0BYVED0H45166
.fortinet.com/	1970-01-19 05:13:56	Name: _gid Value: GA1.2.1643663927.1573949852
.fortinet.com/	1970-01-19 05:12:29	Name: _gat_UA-767980-6 Value: 1
.fortinet.com/	1970-01-19 22:43:41	Name: _ga Value: GA1.2.972752953.1573949852
www.fortinet.com/	1970-01-19 05:12:31	Name: __atuvs Value: 5dd0919c9a6606e4000
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.optmnstr.com
ajax.googleapis.com
analytics.twitter.com
api.opmnstr.com
app.opmnstr.com
assets.adobedtm.com
cm.everesttech.net
connect.facebook.net
d.adroll.com
dpm.demdex.net
fortinet.demdex.net
metrics.fortinet.com
optin-monster.s3.amazonaws.com
px.ads.linkedin.com
s.adroll.com
s7.addthis.com
sjs.bizographics.com
snap.licdn.com
static.ads-twitter.com
t.co
v1.addthisedge.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.googletagmanager.com
www.linkedin.com
z.moatads.com
104.244.42.195
104.244.42.197
15.188.31.119
151.101.112.157
2.18.232.23
2.18.233.40
2.18.235.40
2.21.36.164
23.111.9.217
2a00:1450:4001:806::2008
2a00:1450:4001:808::200e
2a00:1450:4001:81a::200a
2a02:26f0:6c00:296::25ea
2a02:26f0:6c00:2bf::3adf
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:11:101::b93f:9001
2a05:f500:11:101::b93f:9005
3.248.26.129
34.253.43.81
50.17.52.222
52.209.38.145
52.52.208.2
54.231.50.58
66.117.28.86
00b888da67704409cbd106c2141c36adc836e1a4f35510f029cd77d9c1397335
02c46e0e185d5b8e80f549dcbf3ce265cc5f1c77c2fdeb426035a47a52307bf0
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb
1d0194204c2d3c2f02e0dd61ac75a7db82bf71749b8f9947adaf9145c26ba6ab
219ab0ad68af94a75770c2d8404433b3ca47fd6bf900464b058f50c21ed87854
2a00c671b83cdd0986f7aa3f2817a9e19371ea991bb869b0edb60b1edecc7ced
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
41a007ff94447dbf16c92fea8d347a9468347c6663a344d3a39051a3b9d88cf5
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
44bcb425701b97b61a4f915834222632c9fc341437599d9491dd3707d1f1193c
4bc84d9c6d37dd32ee96c55a4c840ed6205a8a36bb8fb999b2a92624704bea13
4e5c000d359e18e247429110f46545e27220c168981dc3f1f3fa9b0de2474aa7
505fea47d9c532beedcc1ac2447c7d3a157e8a68af7b27a9cf0ff711387bfc6d
56118c393aa7a8837f61993f2a1b16fcb0f83f77cf63aa3bad72d84599e8ff7d
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5d7fda52442588c5ae334e48512e3bab1c0a34ed25a9c8ec0c8afe15df3f51d0
6fe342c41e356ff16a92c7c97f47edbd0233227c1ec0dbc73b5e1bcb4f2f100d
7c20e3e201e3d7c6821e907def1257deb544eb08578c7129b96d53bbf62d34e4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87b784071fc3dd6fbe9f0ed8362565d37f3d3eadc97acfda6ec9b9f628ff076f
9a1feb90b6ffeec42d4f7c25ddf2128b404907e8b3503590f4877b0c3f57b30d
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2a5d9a9c7bbd63fcbdad20df962b687d8d228dbbcbc5b10128b7490e0555128
a358cd07b58872d844f9c1bbca1e9313ff187464b900e4de3be0518d4f69568f
a3e7bb0d5bab6ff5e495c935cd71ced832381bda643962a4db9c9a86ad9f04ea
a4466c46018393536d0044282263d56cedfedbadfa2c897d84c7c2a19770cb60
a6e773c3cab0651d5e692012a6e9b5df64ea5374e8c4dc338d99fc5131d89aad
a9deb521436ad37051d51543f2445bb999ddb6f459da1c6165e155aa99e0c4f0
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad979cd8209daf4934baefa31ec4dede21ae9cc233cf809da2ed5ed839f03a68
b2a69f81002746fb20a34679b10c764c2d5f664de10944230824289d55c38348
b688b7d8c9a306ac5fc64ab06561ca04693e1c5d0ea9877a4c853581d04971ea
c7c2a637412317b9e13fd52b5ecff08eb1b5da60b3d66a2a5b8eff7eec182a84
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
d223439f0a00d264eadf96d43a5245e291ff1504db055176eb8a3da4ef532cb4
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d6df1bca3f52fafa22d16bb86bc71723212b30401ea887f94635bb855b2e4ca4
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dbeeb3fa5f0188835b6b6208bc89d641f030e79e27ad5712d427eabd79e6095a
dc8cc75354634f56b7fdcdda16ff8c17ea574432ae8d2153d04d8f347302281d
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

www.fortinet.com Open in urlscan Pro 52.52.208.2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

49 Requests

100 %HTTPS

36 %IPv6

22 Domains

27 Subdomains

24 IPs

5 Countries

1252 kBTransfer

3503 kBSize

16 Cookies

11 Outgoing links

Redirected requests

49 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.fortinet.com Open in urlscan Pro
52.52.208.2 Public Scan

Screenshot
Live screenshot

Full Image

49
Requests

100 %
HTTPS

36 %
IPv6

22
Domains

27
Subdomains

24
IPs

5
Countries

1252 kB
Transfer

3503 kB
Size

16
Cookies

49 HTTP transactions
4 data transactions