urlscan.io logo urlscan.io
SecurityTrails logo

www.fortinet.com Open in urlscan Pro
3.123.216.247  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Submission: On November 21 via api from TR — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 3 countries across 7 domains to perform 33 HTTP transactions. The main IP is 3.123.216.247, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 134887.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 5th 2023. Valid for: a year.
This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
14 3.123.216.247 16509 (AMAZON-02)
6 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
5 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 95.101.111.184 20940 (AKAMAI-ASN1)
1 2a02:26f0:710... 20940 (AKAMAI-ASN1)
1 54.76.185.45 16509 (AMAZON-02)
2 18.195.16.227 16509 (AMAZON-02)
1 2 63.140.62.214 16509 (AMAZON-02)
33 10
14    3.123.216.247 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
www.fortinet.com
6    2606:4700::6812:82ec (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.cookielaw.org
1    2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
5    2a02:26f0:3500:591::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
assets.adobedtm.com
2    95.101.111.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-111-184.deploy.static.akamaitechnologies.com
j.6sc.co
c.6sc.co
1    2a02:26f0:7100::210:180 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
ipv6.6sc.co
1    54.76.185.45 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-185-45.eu-west-1.compute.amazonaws.com
dpm.demdex.net
2    18.195.16.227 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-16-227.eu-central-1.compute.amazonaws.com
epsilon.6sense.com
2    63.140.62.214 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-214.data.adobedc.net
metrics.fortinet.com
Apex Domain
Subdomains		 Transfer
16 fortinet.com
www.fortinet.com — Cisco Umbrella Rank: 134887
metrics.fortinet.com — Cisco Umbrella Rank: 314760
859 KB
6 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 342
116 KB
5 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 466
132 KB
3 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5465
c.6sc.co — Cisco Umbrella Rank: 8564
ipv6.6sc.co — Cisco Umbrella Rank: 5738
18 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9302
672 B
1 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 228
542 B
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 590
315 B
33 7
Domain Requested by
14 www.fortinet.com www.fortinet.com
6 cdn.cookielaw.org www.fortinet.com
cdn.cookielaw.org
5 assets.adobedtm.com cdn.cookielaw.org
assets.adobedtm.com
2 metrics.fortinet.com 1 redirects
2 epsilon.6sense.com j.6sc.co
1 dpm.demdex.net assets.adobedtm.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 j.6sc.co www.fortinet.com
1 geolocation.onetrust.com cdn.cookielaw.org
33 10
Subject Issuer Validity Valid
*.fortinet.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-07-05 -
2024-08-04		 a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3		 2023-04-01 -
2024-03-31		 a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3		 2023-11-13 -
2024-11-12		 a year crt.sh
assets.adobedtm.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-07-11 -
2024-08-10		 a year crt.sh
6sc.co
R3		 2023-11-03 -
2024-02-01		 3 months crt.sh
*.demdex.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-26 -
2024-10-26		 a year crt.sh
*.6sense.com
Amazon RSA 2048 M01		 2023-05-01 -
2024-05-29		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Frame ID: 8CD7A9F4150E3F4CB38ACC84A197EBAF
Requests: 34 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Konni Campaign Distributed Via Malicious Document | FortiGuard LabsBack ButtonFilter Button

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc/designs/
  • /etc\.clientlibs/
Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Page Statistics

33
Requests

97 %
HTTPS

44 %
IPv6

7
Domains

10
Subdomains

10
IPs

3
Countries

1126 kB
Transfer

2676 kB
Size

11
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33
  • https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s67174687595801?AQB=1&ndh=1&pf=1&t=21%2F10%2F2023%203%3A13%3A45%202%20-60&fid=79FEEAFEFB679FE5-2C833082ED4D2EA8&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Akonni-campaign-distributed-via-malicious-document&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Akonni-campaign-distributed-via-malicious-document&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
  • https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s67174687595801?AQB=1&pccr=true&vidn=32AE092C90F28B2D-400004E3BAB7E35D&ndh=1&pf=1&t=21%2F10%2F2023%203%3A13%3A45%202%20-60&fid=79FEEAFEFB679FE5-2C833082ED4D2EA8&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Akonni-campaign-distributed-via-malicious-document&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Akonni-campaign-distributed-via-malicious-document&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

33 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request konni-campaign-distributed-via-malicious-document
www.fortinet.com/blog/threat-research/ 		60 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
30b58aa99ec764c6943eaf55e240c66f323e2d0ca80580bf0feab36fb1b8c0c5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Age
44005
Cache-Control
max-age=600, public, s-maxage=10800
Connection
keep-alive
Content-Encoding
gzip
Content-Length
18595
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Type
text/html;charset=utf-8
Date
Tue, 21 Nov 2023 02:10:08 GMT
ETag
"f188-60a95e805a999-gzip"
Last-Modified
Mon, 20 Nov 2023 14:00:19 GMT
Server
Apache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Id
YfULP4GXmMQQoxPpQast2yH0k5bcks2mlirJgRf2qD8m9WM5YJYB0w==
X-Amz-Cf-Pop
FRA60-P3
X-Cache
Hit from cloudfront
X-Content-Type-Options
nosniff
X-Dispatcher
dispatcher2uswest1
X-Frame-Options
SAMEORIGIN
X-Vhost
publish
X-XSS-Protection
1; mode=block
at.js
www.fortinet.com/etc/designs/fortinet/adb-target/ 		104 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Tue, 14 Nov 2023 22:20:49 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
532384
Connection
keep-alive
Content-Length
47782
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 31 Mar 2023 18:07:12 GMT
Server
Apache
ETag
"19e83-5f836140ef400-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
CIA3GkZlmXUjlID2KdW9NM5XQMmY5N0unKueOVnNRYzPXHm04kwWhw==
clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		540 KB
28 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
bf19e4cab46ebfd04a1438e21bc98c6f520c476918f71d44a96d2523fe0abec4
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Thu, 16 Nov 2023 23:11:15 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
509969
Connection
keep-alive
Content-Length
27479
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 02 Nov 2023 22:08:43 GMT
Server
Apache
ETag
"86e18-60932a18310c0-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css;charset=utf-8
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
XPi6eBBgCWxLJ9RdEIf4vNxh5FnXpybDNd6NxSHVL3vdr6thOGa7Vg==
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b1fc966c38b12c845f9fd8bdb76027106b776783fd44eeed917663942b5fd16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
R1P6TtSHAQZyvOSI/KawHw==
age
80273
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6821
x-ms-lease-status
unlocked
last-modified
Thu, 16 Nov 2023 13:00:35 GMT
server
cloudflare
etag
0x8DBE6A4063D2682
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
10118c61-601e-0090-50fa-1803ed000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82956a48e9e5373e-FRA
fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 		32 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Tue, 21 Nov 2023 02:10:08 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
7737154
Content-Disposition
attachment; filename="fortinet-logo-white.svg"
Connection
keep-alive
Content-Length
1998
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 22 Feb 2018 23:16:01 GMT
Server
Apache
ETag
"7ebb-565d53a1d6e40-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
image/svg+xml
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
6Ebfm45a7dWfLW5xUbsg5r-DOB8zrfqdCerpIJPCRi0wDAQUlAHAHQ==
toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 		1 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Tue, 14 Nov 2023 19:20:31 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
549482
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
1277
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 14 Nov 2023 17:34:13 GMT
Server
Apache
ETag
"4fd-60a2031eb4f40"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
Cn-sk0KPiEi-rYUfm2Ha-1C3KBLyOMQThZjo8NNVVjKnMxNZk6tF5A==
clientlib-base.min.js
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		155 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
56d66430090e27fceeda2a790e5c3b03d0c4eb2b8e0e1fefd94814cc48b8ffd5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Fri, 17 Nov 2023 21:34:38 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
388169
Connection
keep-alive
Content-Length
71658
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 09 Nov 2023 23:20:40 GMT
Server
Apache
ETag
"26ba9-609c073b6e200-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
application/javascript;charset=utf-8
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
wugwhlahgJYEzGOpEYFGa0h27iKsbo01em8gFdoJgD2ZbM-uoEETbQ==
f85f39fc-d7aa-467a-b762-fbb722748016.json
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a334f368b502d68bcaafb174022cfe21775f1744f0a1cd520d0c57d094a8e66a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
79224
content-md5
ypNp2Paf3c+p42YUXiXMnA==
content-length
1413
x-ms-lease-status
unlocked
last-modified
Fri, 12 Feb 2021 00:26:33 GMT
server
cloudflare
etag
0x8D8CEECD9FE5833
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
d0921ad3-b01e-0048-78ce-1224b4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82956a492f66360f-FRA
expires
Wed, 22 Nov 2023 02:13:44 GMT
fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 		32 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Tue, 21 Nov 2023 02:10:08 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Content-Encoding
gzip
Via
1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
X-Vhost
publish
X-Cache
Hit from cloudfront
Age
7737154
Content-Disposition
attachment; filename="fortinet-logo-white.svg"
Connection
keep-alive
Content-Length
1998
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 22 Feb 2018 23:16:01 GMT
Server
Apache
ETag
"7ebb-565d53a1d6e40-gzip"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
image/svg+xml
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
g7dRd6p3VhHDvShLEkwN5nLWen4TdDfuibEfLqF9co9l92JNBi3drg==
truncated
/ 		71 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/png
konni-hero.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 		395 KB
396 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-heros/konni-hero.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
0c4756f22ee0937992d1ab3097ab272c4f8b1b0c5d536ca1e87479e23bb82f50
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Mon, 20 Nov 2023 14:03:20 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
43828
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
404486
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 17 Nov 2023 21:06:25 GMT
Server
Apache
ETag
"62c06-60a5f82545640"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
yShP8ApxCxOODKTOarIJApUxM-Q5UDge2dzI0AnCmJ-hhp1WdaHF1A==
IZ1H9-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 		49 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-heros/IZ1H9-thumbnail.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
cf0a2beeffb966666747d2c988736a6eb10a24a353ba17ec5f3a7ea917d9d88d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Mon, 20 Nov 2023 14:02:21 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
43883
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
50413
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 06 Oct 2023 21:42:58 GMT
Server
Apache
ETag
"c4ed-607131fb51c80"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
M-knZG5gXYeN24BKb2YoAxh0DCHvtythrbwq4WvzuX30j6dsJucUBA==
originbotnet-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 		41 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-heros/originbotnet-thumbnail.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
2c8e1cbe0b7545a74848dc581d340dd408488dfdb9466073b1cc91c563948050
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Mon, 20 Nov 2023 14:02:21 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 544814e402956ba93c0a2d2b923e94c2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
43883
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
42440
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 08 Sep 2023 17:25:22 GMT
Server
Apache
ETag
"a5c8-604dc42e6c480"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
oheI6y5QY2dMfnHpLlwpySNpvO-S3w2BK5H4oXBoQCMrTNmfTtTaJg==
coldfusion-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 		50 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-heros/coldfusion-thumbnail.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
965b1ea2f295f291ed61d2a575372a5af29b4123580089d5d4588dbf3f35095b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Tue, 21 Nov 2023 02:10:08 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
6086278
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
50775
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 29 Aug 2023 05:53:08 GMT
Server
Apache
ETag
"c657-604096cde7900"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
Jvm1tdycNGTy5AktKsx0PLxuZ6bLnmd1nc-GQHjCE0rU1pid0_Ja4g==
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 		37 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css
Origin
https://www.fortinet.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Tue, 14 Nov 2023 22:22:34 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
532384
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
37716
X-XSS-Protection
1; mode=block
Last-Modified
Wed, 18 May 2022 21:11:25 GMT
Server
Apache
ETag
"9354-5df4fb32c7940"
X-Frame-Options
SAMEORIGIN
Content-Type
application/octet-stream
Cache-Control
max-age=2000000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
sDMM00fowgYQXIksNxf9nIH0KnY3KR-qyzL-7Mm3bQGQpMdVzvOs4w==
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 		68 B
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.fortinet.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 02:13:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
82956a498db865ac-FRA
access-control-allow-headers
Content-Type
fig01-konni-telemetry.png
www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1700254190937/ 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1700254190937/fig01-konni-telemetry.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
93f325c8c987b7e36ecffcdf1e5b03850f4753d6be7c4d1ef4cedd150f0bbf56
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Mon, 20 Nov 2023 14:10:41 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
43383
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
18977
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 17 Nov 2023 20:49:50 GMT
Server
Apache
ETag
"4a21-60a5f4705d780"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
aMLSgBAzeC86o-qdR--ss0op4UuYBTn8VN-BRi33tp7yGd8ebY9S6w==
fig02-konni-word-doc.png
www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document/_jcr_content/root/responsivegrid/table_content/par/image_1322278370.img.png/1700254229787/ 		81 KB
82 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document/_jcr_content/root/responsivegrid/table_content/par/image_1322278370.img.png/1700254229787/fig02-konni-word-doc.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-216-247.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
fc79570d7e5c5cffaa8a08ebf5f2e6242401b56fef5adfa4f9131f4f8aa36ad6
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Mon, 20 Nov 2023 14:10:41 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self' https://www.fortinet.com
Via
1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P3
Age
43383
X-Vhost
publish
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
82457
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 17 Nov 2023 20:50:29 GMT
Server
Apache
ETag
"14219-60a5f4958ef40"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
X-Amz-Cf-Id
kJbuQPsA2CWcw8QOqTRVIJqphLtWc4e8FF9e6RKHjJt6fAT25x2h6w==
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/gif
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.10.0/ 		356 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Bh9exWOPGIwRshWljrtlEw==
age
4130
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
79698
x-ms-lease-status
unlocked
last-modified
Thu, 03 Dec 2020 02:43:00 GMT
server
cloudflare
etag
0x8D89735260901BC
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
28c2f04c-701e-009c-1f7c-eb94e5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82956a49ba4f373e-FRA
en.json
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/2149c787-bccf-419d-b831-2a3ac6bafc66/ 		62 KB
14 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/2149c787-bccf-419d-b831-2a3ac6bafc66/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
047f3105c9c1c03b56fb255cbb8cbfbad3a41aeab4928d722f42be59e48175fb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
71007
content-md5
PDee2klF9h+xwI77VTWe9Q==
content-length
14507
x-ms-lease-status
unlocked
last-modified
Fri, 12 Feb 2021 00:26:39 GMT
server
cloudflare
etag
0x8D8CEECDD98A1AE
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
6b6f1c5b-501e-0032-054e-0d39f4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82956a49efcd360f-FRA
expires
Wed, 22 Nov 2023 02:13:44 GMT
otCenterRounded.json
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 		9 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otCenterRounded.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
SH1nUCPouc1JVrHnvxpQbg==
age
71213
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2857
x-ms-lease-status
unlocked
last-modified
Thu, 03 Dec 2020 02:42:51 GMT
server
cloudflare
etag
0x8D89735210A49EB
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
5390ca5d-e01e-00b9-39e1-5a3be8000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82956a4a2fe4360f-FRA
otPcTab.json
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 		45 KB
12 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
zNsRoM1FEmsEgJoYMCNTng==
age
80898
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
11755
x-ms-lease-status
unlocked
last-modified
Thu, 03 Dec 2020 02:42:53 GMT
server
cloudflare
etag
0x8D897352245C4EA
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
9545b78e-701e-013b-03e1-5adced000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82956a4a2fe5360f-FRA
launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
assets.adobedtm.com/ 		481 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
c612f86755bb24e8bedbd2c0d43f4abb9898c5b087ad3bf1add95cf0a1c75e30

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
last-modified
Mon, 20 Nov 2023 17:42:23 GMT
server
AkamaiNetStorage
etag
"df1abbcf6d25cbf18a1f95ff08b80c54:1700502143.088196"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
119037
expires
Tue, 21 Nov 2023 03:13:44 GMT
AppMeasurement.min.js
assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
6c789117a5f69b39293256e6899288c8317358589e20c6d08278223f948cd2cf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
last-modified
Tue, 12 Sep 2023 05:33:26 GMT
server
AkamaiNetStorage
etag
"208eb534ea01036a4fca64e6715ccf3f:1694496806.451282"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
12687
expires
Tue, 21 Nov 2023 03:13:44 GMT
AppMeasurement_Module_ActivityMap.min.js
assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement_Module_ActivityMap.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
bc0bfc50d3ff4175132b7da1ef0adf7761ded5cb2782e55edb1948da3480abd8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
last-modified
Tue, 12 Sep 2023 05:33:26 GMT
server
AkamaiNetStorage
etag
"f1e098a5dd836ea5fc9726c429c8d71d:1694496806.740373"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
1597
expires
Tue, 21 Nov 2023 03:13:44 GMT
6si.min.js
j.6sc.co/ 		63 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
8c2b5a2945535269c1cefe505e56b663f26b3d322d35ab4fa835a24c543226dc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 15 Nov 2023 22:43:30 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"65554992-fd89"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
17416
expires
Tue, 21 Nov 2023 02:13:44 GMT
RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4bbf0fcf2e57/ 		358 B
484 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4bbf0fcf2e57/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
5f4fdced3c6e60620c6b3164b0673eb3d4d4ecaf2e0dbb60fc3ec6c6b3040b14

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
last-modified
Mon, 20 Nov 2023 17:42:23 GMT
server
AkamaiNetStorage
etag
"a5ad10d149278108251b371e500b9e46:1700502143.842528"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
228
expires
Tue, 21 Nov 2023 03:13:44 GMT
RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4bbf0fcf2e57/ 		2 KB
980 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4bbf0fcf2e57/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
d89455781c26bc19e694a6b49ab41d962df99886e1bd5f88f92d042f969682b9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 02:13:44 GMT
content-encoding
gzip
last-modified
Mon, 20 Nov 2023 17:42:23 GMT
server
AkamaiNetStorage
etag
"a5ad10d149278108251b371e500b9e46:1700502143.842528"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
723
expires
Tue, 21 Nov 2023 03:13:44 GMT
/
c.6sc.co/ 		7 B
194 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 02:13:44 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.fortinet.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/ 		14 B
300 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100::210:180 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fbb3bcb80a056423c4e9c19e56998a54ac7444913f387f2294acd76786fad9dc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 02:13:44 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:5a::4
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1700532824868_34603388_487738285_15_605_6_15_219";dur=1
content-length
14
expires
Tue, 21 Nov 2023 02:13:44 GMT
optOutStatus
dpm.demdex.net/ 		41 B
542 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/optOutStatus?d_visid_ver=5.5.0&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1700532824919
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.76.185.45 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-76-185-45.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e5873dbdaa376d924cfa4b2ba4b1622d4e6e483866e2b7bc24ef3007ff5960e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.fortinet.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

dcs
dcs-prod-irl1-2-v054-0036c8079.edge-irl1.demdex.com 1 ms
pragma
no-cache
date
Tue, 21 Nov 2023 02:13:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-tid
WpzlFxeVQxY=
vary
Origin
content-type
application/json;charset=utf-8
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials
true
content-length
60
expires
Thu, 01 Jan 1970 00:00:00 UTC
details
epsilon.6sense.com/v3/company/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.16.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-16-227.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://www.fortinet.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.fortinet.com
access-control-expose-headers
X-6si-Region
access-control-max-age
1800
date
Tue, 21 Nov 2023 02:13:45 GMT
server
nginx
timing-allow-origin
https://6sense.com, https://www.ssga.com
x-6si-region
eu-central-1a
details
epsilon.6sense.com/v3/company/ 		726 B
672 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.16.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-16-227.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e4467e5e450f09b28e5f90e57af82e92968e748e34cb0542a123035fa280cca5

Request headers

Referer
https://www.fortinet.com/
accept-language
de-DE,de;q=0.9
Authorization
Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
X-6s-CustomID
WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36

Response headers

date
Tue, 21 Nov 2023 02:13:45 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
x-6si-region
eu-central-1a
access-control-allow-origin
https://www.fortinet.com
access-control-expose-headers
X-6si-Region
access-control-allow-credentials
true
timing-allow-origin
https://6sense.com, https://www.ssga.com
content-length
387
s67174687595801
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/
Redirect Chain
  • https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s67174687595801?AQB=1&ndh=1&pf=1&t=21%2F10%2F2023%203%3A13%3A45%202%20-60&fid=79FEEAFEFB679FE5-2C833082ED4D2EA8&ce=UTF-8&pag...
  • https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s67174687595801?AQB=1&pccr=true&vidn=32AE092C90F28B2D-400004E3BAB7E35D&ndh=1&pf=1&t=21%2F10%2F2023%203%3A13%3A45%202%20-60&f...
43 B
249 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s67174687595801?AQB=1&pccr=true&vidn=32AE092C90F28B2D-400004E3BAB7E35D&ndh=1&pf=1&t=21%2F10%2F2023%203%3A13%3A45%202%20-60&fid=79FEEAFEFB679FE5-2C833082ED4D2EA8&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Akonni-campaign-distributed-via-malicious-document&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Akonni-campaign-distributed-via-malicious-document&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
Protocol
H2
Server
63.140.62.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-63-140-62-214.data.adobedc.net
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 02:13:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Wed, 22 Nov 2023 02:13:45 GMT
server
jag
etag
3651866435683123200-4617925529214887636
vary
*
p3p
CP="This is not a P3P policy"
access-control-allow-origin
*
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-length
43
x-xss-protection
1; mode=block
expires
Mon, 20 Nov 2023 02:13:45 GMT

Redirect headers

pragma
no-cache
date
Tue, 21 Nov 2023 02:13:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Wed, 22 Nov 2023 02:13:45 GMT
server
jag
vary
Origin
p3p
CP="This is not a P3P policy"
access-control-allow-origin
*
location
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s67174687595801?AQB=1&pccr=true&vidn=32AE092C90F28B2D-400004E3BAB7E35D&ndh=1&pf=1&t=21%2F10%2F2023%203%3A13%3A45%202%20-60&fid=79FEEAFEFB679FE5-2C833082ED4D2EA8&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Akonni-campaign-distributed-via-malicious-document&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Akonni-campaign-distributed-via-malicious-document&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
content-type
text/plain;charset=utf-8
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-length
0
x-xss-protection
1; mode=block
expires
Mon, 20 Nov 2023 02:13:45 GMT

Verdicts & Comments Add Verdict or Comment

69 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture object| OneTrustStub function| OptanonWrapper object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| setImmediate function| clearImmediate function| $ function| jQuery string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| Optanon object| OneTrust object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in number| timer_e object| _6si function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq function| AppMeasurement_Module_ActivityMap object| Sixsct object| t function| liberatedGetOptOut boolean| _storagePopulated object| s_i_fortinetincproduction object| targetGlobalSettings

11 Cookies

Domain/Path Name / Value
www.fortinet.com/ Name: cookiesession1
Value: 678A3E2436DB57E21812DF48041935A4
www.fortinet.com/ Name: AWSALB
Value: yQ/aoiFowjTExmKLgNwcKToZuHGX58lslc7c6pEnMb1a50GcMzKNMy1D/LX6ea56j2rd9vKDqzfYvPdxbuPgcqdJNYP/yLvRSeaoaBJ/0AwuGOCNKoERqEqKu83H3iY1m+fJwnLXmL7GRZmeeV9VM7nR5e+AOaeUvbbEPeIFD1qOQFq42mwZ6TUqfRJm4CPEyoelzyksNnwc4gQj9TJBFg==
www.fortinet.com/ Name: AWSALBCORS
Value: yQ/aoiFowjTExmKLgNwcKbnzFLkxfBthZ3KpPrRt2J3fxc2Wek508+RjzdgGe0f7hf0JCfNcVAKdBREN3Y/9O8Zica8BdV5WBsuafUPgVhBDNO4as7t0FR5AYcO7XzKNlImSG2Ct4T6XUKftvXC3u0K3P0WhVw7pcuMs4HceznSO7nBGxZV0WBCEwwOCvfEuFHQeheDRYVM6cxAbbDhfKQ==
.fortinet.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Tue+Nov+21+2023+03%3A13%3A44+GMT%2B0100+(Central+European+Standard+Time)&version=6.10.0&hosts=&consentId=b7d0c221-eaf2-420a-bc1a-635bb4886fd5&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
www.fortinet.com/ Name: aa_cc
Value: DE
www.fortinet.com/ Name: aa_cn
Value: DE
.fortinet.com/ Name: s_fid
Value: 79FEEAFEFB679FE5-2C833082ED4D2EA8
.fortinet.com/ Name: gpv_pn
Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fkonni-campaign-distributed-via-malicious-document
.fortinet.com/ Name: s_getNewRepeat
Value: 1700532825059-New
.fortinet.com/ Name: s_cc
Value: true
.fortinet.com/ Name: s_vi
Value: [CS]v1|32AE092C90F28B2D-400004E3BAB7E35D[CE]

1 Console Messages

Source Level URL
Text
javascript warning URL: https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Message:
The resource https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
c.6sc.co
cdn.cookielaw.org
dpm.demdex.net
epsilon.6sense.com
geolocation.onetrust.com
ipv6.6sc.co
j.6sc.co
metrics.fortinet.com
www.fortinet.com
18.195.16.227
2606:4700:4400::ac40:9b77
2606:4700::6812:82ec
2a02:26f0:3500:591::1e80
2a02:26f0:7100::210:180
3.123.216.247
54.76.185.45
63.140.62.214
95.101.111.184
047f3105c9c1c03b56fb255cbb8cbfbad3a41aeab4928d722f42be59e48175fb
0c4756f22ee0937992d1ab3097ab272c4f8b1b0c5d536ca1e87479e23bb82f50
2c8e1cbe0b7545a74848dc581d340dd408488dfdb9466073b1cc91c563948050
30b58aa99ec764c6943eaf55e240c66f323e2d0ca80580bf0feab36fb1b8c0c5
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7
56d66430090e27fceeda2a790e5c3b03d0c4eb2b8e0e1fefd94814cc48b8ffd5
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5f4fdced3c6e60620c6b3164b0673eb3d4d4ecaf2e0dbb60fc3ec6c6b3040b14
6b1fc966c38b12c845f9fd8bdb76027106b776783fd44eeed917663942b5fd16
6c789117a5f69b39293256e6899288c8317358589e20c6d08278223f948cd2cf
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
8c2b5a2945535269c1cefe505e56b663f26b3d322d35ab4fa835a24c543226dc
93f325c8c987b7e36ecffcdf1e5b03850f4753d6be7c4d1ef4cedd150f0bbf56
965b1ea2f295f291ed61d2a575372a5af29b4123580089d5d4588dbf3f35095b
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a334f368b502d68bcaafb174022cfe21775f1744f0a1cd520d0c57d094a8e66a
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bc0bfc50d3ff4175132b7da1ef0adf7761ded5cb2782e55edb1948da3480abd8
bf19e4cab46ebfd04a1438e21bc98c6f520c476918f71d44a96d2523fe0abec4
c612f86755bb24e8bedbd2c0d43f4abb9898c5b087ad3bf1add95cf0a1c75e30
cf0a2beeffb966666747d2c988736a6eb10a24a353ba17ec5f3a7ea917d9d88d
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d89455781c26bc19e694a6b49ab41d962df99886e1bd5f88f92d042f969682b9
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
e4467e5e450f09b28e5f90e57af82e92968e748e34cb0542a123035fa280cca5
e5873dbdaa376d924cfa4b2ba4b1622d4e6e483866e2b7bc24ef3007ff5960e7
e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fbb3bcb80a056423c4e9c19e56998a54ac7444913f387f2294acd76786fad9dc
fc79570d7e5c5cffaa8a08ebf5f2e6242401b56fef5adfa4f9131f4f8aa36ad6
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a