www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa#new_tab
Effective URL:
https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Submission: On October 18 via api (October 18th 2024, 8:45:17 am UTC) from IN — Scanned from US

Summary HTTP 231 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 73 IPs in 2 countries across 62 domains to perform 231 HTTP transactions. The main IP is 2600:1f18:1492:1701:a964:c08d:f5eb:b0c, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 120260.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 16th 2024. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
66	2600:1f18:149... 2600:1f18:1492:1701:a964:c08d:f5eb:b0c	14618 (AMAZON-AES) (AMAZON-AES)
6	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	2600:1408:c40... 2600:1408:c400:195::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 4	18.206.129.203 18.206.129.203	14618 (AMAZON-AES) (AMAZON-AES)
4	2606:4700::68... 2606:4700::6813:9308	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	23.212.251.6 23.212.251.6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.62.165.92 23.62.165.92	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.86.110.8 34.86.110.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
8	2607:f8b0:400... 2607:f8b0:400d:c0f::61	15169 (GOOGLE) (GOOGLE)
1	54.85.187.162 54.85.187.162	14618 (AMAZON-AES) (AMAZON-AES)
1 1	52.34.176.237 52.34.176.237	16509 (AMAZON-02) (AMAZON-02)
1	63.140.39.45 63.140.39.45	14618 (AMAZON-AES) (AMAZON-AES)
3	64.202.112.191 64.202.112.191	23352 (SERVERCEN...) (SERVERCENTRAL)
1	2600:1408:c40... 2600:1408:c400:d::17cd:6a47	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2607:f8b0:400... 2607:f8b0:400d:c0b::8a	15169 (GOOGLE) (GOOGLE)
2	2400:52e0:1a0... 2400:52e0:1a00::1207:2	200325 (BUNNYCDN) (BUNNYCDN)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:400d:c0d::9b	15169 (GOOGLE) (GOOGLE)
1	209.85.144.149 209.85.144.149	15169 (GOOGLE) (GOOGLE)
1 4	2607:f8b0:400... 2607:f8b0:4004:c1f::9d	15169 (GOOGLE) (GOOGLE)
2	18.216.31.172 18.216.31.172	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:310... 2606:4700:3108::ac42:2af8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1347	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.32.164.86 52.32.164.86	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:bdf::41 2620:1ec:bdf::41	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	216.200.232.249 216.200.232.249	30419 (PAEDAE-INC) (PAEDAE-INC)
3	2607:f8b0:400... 2607:f8b0:400d:c0b::93	15169 (GOOGLE) (GOOGLE)
1	63.140.39.65 63.140.39.65	14618 (AMAZON-AES) (AMAZON-AES)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a04:4e42:400... 2a04:4e42:400::485	54113 (FASTLY) (FASTLY)
2	44.226.187.177 44.226.187.177	16509 (AMAZON-02) (AMAZON-02)
1	52.7.151.245 52.7.151.245	14618 (AMAZON-AES) (AMAZON-AES)
1	146.75.76.157 146.75.76.157	54113 (FASTLY) (FASTLY)
1	2600:1408:c40... 2600:1408:c400:5::17c7:3719	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	52.22.110.67 52.22.110.67	14618 (AMAZON-AES) (AMAZON-AES)
2 3	68.67.161.182 68.67.161.182	29990 (ASN-APPNEX) (ASN-APPNEX)
3 5	68.67.161.208 68.67.161.208	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:214... 2600:9000:2141:6400:12:dfa9:e200:93a1	16509 (AMAZON-02) (AMAZON-02)
21 24	35.194.66.159 35.194.66.159	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	2600:9000:230... 2600:9000:2305:c800:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	69.194.240.13 69.194.240.13	26120 (RHYTHMONE) (RHYTHMONE)
1 2	35.71.139.29 35.71.139.29	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4200:5e2b:8808:4329:7b7f	14618 (AMAZON-AES) (AMAZON-AES)
3 4	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	108.138.128.44 108.138.128.44	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:21f... 2600:9000:21f9:7200:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2600:9000:207... 2600:9000:2073:7a00:1b:6b7d:2300:93a1	16509 (AMAZON-02) (AMAZON-02)
1	207.65.37.184 207.65.37.184	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	63.251.28.211 63.251.28.211	26558 (FREEWHEEL) (FREEWHEEL)
2 3	2600:1901:0:8... 2600:1901:0:8eee::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	2001:4998:60:... 2001:4998:60:807::2	14196 (YAHOO-CHA) (YAHOO-CHA)
1 1	2001:4998:60:... 2001:4998:60:807::1	14196 (YAHOO-CHA) (YAHOO-CHA)
1 2	34.229.3.43 34.229.3.43	14618 (AMAZON-AES) (AMAZON-AES)
1	34.193.229.172 34.193.229.172	14618 (AMAZON-AES) (AMAZON-AES)
1	23.220.132.230 23.220.132.230	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	54.159.21.67 54.159.21.67	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.206.151.111 34.206.151.111	14618 (AMAZON-AES) (AMAZON-AES)
3 3	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	107.178.254.65 107.178.254.65	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 6	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	64.233.180.156 64.233.180.156	15169 (GOOGLE) (GOOGLE)
1 2	69.173.146.5 69.173.146.5	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
3 3	173.194.205.157 173.194.205.157	15169 (GOOGLE) (GOOGLE)
1	44.212.189.233 44.212.189.233	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2606:4700:440... 2606:4700:4400::ac40:92d7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	142.250.31.148 142.250.31.148	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f00... 2a03:2880:f003:c0e:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700:303... 2606:4700:3035::6815:3296	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
1	54.203.236.163 54.203.236.163	16509 (AMAZON-02) (AMAZON-02)
1 6	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	54.86.120.18 54.86.120.18	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f10... 2a03:2880:f103:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
8 9	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2 3	44.196.77.126 44.196.77.126	14618 (AMAZON-AES) (AMAZON-AES)
2	52.89.99.220 52.89.99.220	16509 (AMAZON-02) (AMAZON-02)
1	35.81.162.201 35.81.162.201	16509 (AMAZON-02) (AMAZON-02)
1	44.225.29.129 44.225.29.129	16509 (AMAZON-02) (AMAZON-02)
231	73

66 2600:1f18:1492:1701:a964:c08d:f5eb:b0c (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2600:1408:c400:195::1e80 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.206.129.203 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-206-129-203.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 23.212.251.6 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-212-251-6.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.62.165.92 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-62-165-92.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wave.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.86.110.8 (Washington, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.110.86.34.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2607:f8b0:400d:c0f::61 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.85.187.162 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-187-162.compute-1.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.34.176.237 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-34-176-237.us-west-2.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.45 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-45.data.adobedc.net

fortinet.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 64.202.112.191 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:c400:d::17cd:6a47 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c0b::8a (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:52e0:1a00::1207:2 (Chicago, United States)

ASN200325 (BUNNYCDN, SI)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:400d:c0d::9b (Morganton, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.85.144.149 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: qv-in-f149.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c1f::9d (Washington, United States) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.216.31.172 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-216-31-172.us-east-2.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:2af8 (United States)

ASN13335 (CLOUDFLARENET, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1347 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.32.164.86 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-164-86.us-west-2.compute.amazonaws.com

abm-tracking.demandscience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::41 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

tmp.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.200.232.249 (Frederick, United States)

ASN30419 (PAEDAE-INC, US)

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:400d:c0b::93 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.65 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-65.data.adobedc.net

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.226.187.177 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-226-187-177.us-west-2.compute.amazonaws.com

intentstream.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.7.151.245 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-7-151-245.compute-1.amazonaws.com

dx.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.76.157 (Chicago, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:c400:5::17c7:3719 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.22.110.67 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-110-67.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.67.161.182 (Colonia, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 68.67.161.208 (Colonia, United States) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2141:6400:12:dfa9:e200:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.inzynk.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 35.194.66.159 (Washington, United States) 21 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 159.66.194.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2305:c800:1b:5138:8a40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.194.240.13 (United States)

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.139.29 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4200:5e2b:8808:4329:7b7f (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.111.113.62 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.128.44 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-44.jfk50.r.cloudfront.net

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f9:7200:19:fc2c:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2073:7a00:1b:6b7d:2300:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 207.65.37.184 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.251.28.211 (Secaucus, United States)

ASN26558 (FREEWHEEL, US)

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbid.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:60:807::2 (United States) 1 redirects

ASN14196 (YAHOO-CHA, US)

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:60:807::1 (United States) 1 redirects

ASN14196 (YAHOO-CHA, US)

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.229.3.43 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-229-3-43.compute-1.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.193.229.172 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-193-229-172.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.220.132.230 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-220-132-230.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.159.21.67 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-159-21-67.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.206.151.111 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-151-111.compute-1.amazonaws.com

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.154.8 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.178.254.65 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.233.180.156 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: on-in-f156.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.146.5 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 173.194.205.157 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: qm-in-f157.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.212.189.233 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-212-189-233.compute-1.amazonaws.com

44.212.189.233	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:92d7 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.31.148 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bj-in-f148.1e100.net

10104846.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f003:c0e:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6815:3296 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.203.236.163 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-236-163.us-west-2.compute.amazonaws.com

tracking.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.117.77.79 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.86.120.18 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-86-120-18.compute-1.amazonaws.com

6033413.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f103:181:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 52.223.40.198 (United States) 8 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 44.196.77.126 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-196-77-126.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.89.99.220 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-89-99-220.us-west-2.compute.amazonaws.com

px.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.81.162.201 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-81-162-201.us-west-2.compute.amazonaws.com

gs.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.225.29.129 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-225-29-129.us-west-2.compute.amazonaws.com

px.steelhousemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
67	fortinet.com www.fortinet.com — Cisco Umbrella Rank: 120260 metrics.fortinet.com — Cisco Umbrella Rank: 303802	5 MB
26	simpli.fi 21 redirects tag.simpli.fi — Cisco Umbrella Rank: 4957 i.simpli.fi — Cisco Umbrella Rank: 4183 um.simpli.fi — Cisco Umbrella Rank: 913	15 KB
22	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 430	151 KB
14	doubleclick.net 5 redirects td.doubleclick.net — Cisco Umbrella Rank: 192 ad.doubleclick.net — Cisco Umbrella Rank: 150 googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 cm.g.doubleclick.net — Cisco Umbrella Rank: 283 10104846.fls.doubleclick.net — Cisco Umbrella Rank: 324916	7 KB
13	6sc.co j.6sc.co — Cisco Umbrella Rank: 5626 c.6sc.co — Cisco Umbrella Rank: 6951 ipv6.6sc.co — Cisco Umbrella Rank: 5794 b.6sc.co — Cisco Umbrella Rank: 3611 eps.6sc.co — Cisco Umbrella Rank: 11869	22 KB
9	adsrvr.org 8 redirects match.adsrvr.org — Cisco Umbrella Rank: 373 insight.adsrvr.org — Cisco Umbrella Rank: 945	7 KB
8	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 www.linkedin.com — Cisco Umbrella Rank: 646 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	5 KB
8	adnxs.com 5 redirects secure.adnxs.com — Cisco Umbrella Rank: 479 ib.adnxs.com — Cisco Umbrella Rank: 267	9 KB
8	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	746 KB
6	ml314.com 1 redirects ml314.com — Cisco Umbrella Rank: 1614	40 KB
6	outbrain.com amplify.outbrain.com — Cisco Umbrella Rank: 3182 wave.outbrain.com — Cisco Umbrella Rank: 3153 tr.outbrain.com — Cisco Umbrella Rank: 3133 sync.outbrain.com — Cisco Umbrella Rank: 881	11 KB
6	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2568 tracking.crazyegg.com — Cisco Umbrella Rank: 4786	41 KB
6	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	127 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 243 fortinet.demdex.net — Cisco Umbrella Rank: 337765	3 KB
4	tapad.com 3 redirects pixel.tapad.com — Cisco Umbrella Rank: 446	1 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 2579	10 KB
4	mountain.com dx.mountain.com — Cisco Umbrella Rank: 4802 px.mountain.com — Cisco Umbrella Rank: 5019 gs.mountain.com — Cisco Umbrella Rank: 9568	11 KB
3	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1074	2 KB
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 962	818 B
3	t.co t.co — Cisco Umbrella Rank: 859	2 KB
3	rlcdn.com 3 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 462	848 B
3	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2566 pbid.pro-market.net — Cisco Umbrella Rank: 9935	1 KB
3	contanuity.com intentstream.contanuity.com — Cisco Umbrella Rank: 54170 tracking.contanuity.com — Cisco Umbrella Rank: 17825	1 KB
3	google.com www.google.com — Cisco Umbrella Rank: 3	192 B
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 25487 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23670	2 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 348	15 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	4 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	71 KB
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 516	502 B
2	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 413	3 KB
2	lijit.com 1 redirects ce.lijit.com — Cisco Umbrella Rank: 912	895 B
2	crwdcntrl.net 1 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 976	554 B
2	exelator.com 1 redirects loadm.exelator.com — Cisco Umbrella Rank: 1779	2 KB
2	yahoo.com 2 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 1830 ups.analytics.yahoo.com — Cisco Umbrella Rank: 495	805 B
2	intentiq.com 1 redirects sync.intentiq.com — Cisco Umbrella Rank: 993	2 KB
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 542 d.agkn.com — Cisco Umbrella Rank: 782	1 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 415	966 B
2	demandscience.com abm-tracking.demandscience.com — Cisco Umbrella Rank: 51915	3 KB
2	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 6545 api.omappapi.com — Cisco Umbrella Rank: 6555	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34
1	steelhousemedia.com px.steelhousemedia.com — Cisco Umbrella Rank: 13137	319 B
1	siteimproveanalytics.io 6033413.global.siteimproveanalytics.io — Cisco Umbrella Rank: 291663	149 B
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3660	12 KB
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 89	23 B
1	pippio.com 1 redirects pippio.com — Cisco Umbrella Rank: 751	632 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 1137	27 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1507	421 B
1	stickyadstv.com ads.stickyadstv.com — Cisco Umbrella Rank: 576	659 B
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 867	551 B
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6710	175 B
1	1rx.io sync.1rx.io — Cisco Umbrella Rank: 503	99 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 582	535 B
1	inzynk.io tags.inzynk.io — Cisco Umbrella Rank: 205998	443 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 960	15 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 311	14 KB
1	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 3455	711 B
1	argusplatform.com tmp.argusplatform.com — Cisco Umbrella Rank: 329188 pixels.argusplatform.com Failed webtracker.argusplatform.com Failed	3 KB
1	opmnstr.com a.opmnstr.com — Cisco Umbrella Rank: 32696	17 KB
1	omtrdc.net fortinet.tt.omtrdc.net — Cisco Umbrella Rank: 316588	842 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1371	490 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	305 B
231	62

	Domain	Requested by
66	www.fortinet.com	www.fortinet.com
24	um.simpli.fi	21 redirects
22	assets.adobedtm.com	cdn.cookielaw.org assets.adobedtm.com
8	match.adsrvr.org	7 redirects
8	b.6sc.co	www.fortinet.com
8	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com abm-tracking.demandscience.com
6	ml314.com	1 redirects www.fortinet.com ml314.com
6	px.ads.linkedin.com	3 redirects snap.licdn.com
6	cdn.cookielaw.org	www.fortinet.com cdn.cookielaw.org
5	ib.adnxs.com	3 redirects
4	pixel.tapad.com	3 redirects
4	tags.srv.stackadapt.com	www.fortinet.com tags.srv.stackadapt.com
4	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
4	td.doubleclick.net	www.googletagmanager.com
4	script.crazyegg.com	www.fortinet.com script.crazyegg.com
4	dpm.demdex.net	1 redirects www.fortinet.com
3	ps.eyeota.net	2 redirects
3	analytics.twitter.com
3	t.co
3	cm.g.doubleclick.net	3 redirects
3	idsync.rlcdn.com	3 redirects
3	secure.adnxs.com	2 redirects
3	www.google.com	www.fortinet.com
3	bat.bing.com	assets.adobedtm.com bat.bing.com www.fortinet.com
2	px.mountain.com	dx.mountain.com px.mountain.com
2	www.facebook.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	10104846.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	us-u.openx.net	1 redirects
2	pixel.rubiconproject.com	1 redirects
2	ce.lijit.com	1 redirects
2	bcp.crwdcntrl.net	1 redirects
2	loadm.exelator.com	1 redirects
2	fei.pro-market.net	2 redirects
2	sync.intentiq.com	1 redirects
2	eb2.3lift.com	1 redirects
2	intentstream.contanuity.com	abm-tracking.demandscience.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	abm-tracking.demandscience.com	www.fortinet.com abm-tracking.demandscience.com
2	tracking.crazyegg.com	script.crazyegg.com
2	eps.6sc.co	j.6sc.co
2	www.google-analytics.com	www.googletagmanager.com
2	tr.outbrain.com	amplify.outbrain.com
2	amplify.outbrain.com	www.fortinet.com amplify.outbrain.com
1	insight.adsrvr.org	1 redirects
1	px.steelhousemedia.com
1	gs.mountain.com	px.mountain.com
1	6033413.global.siteimproveanalytics.io
1	tracking.contanuity.com	abm-tracking.demandscience.com
1	siteimproveanalytics.com	assets.adobedtm.com
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	www.googleadservices.com	1 redirects
1	pippio.com	1 redirects
1	stags.bluekai.com
1	sync.bfmio.com
1	pbid.pro-market.net
1	ups.analytics.yahoo.com	1 redirects
1	cms.analytics.yahoo.com	1 redirects
1	ads.stickyadstv.com
1	image2.pubmatic.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.1rx.io
1	sync.outbrain.com
1	s.ad.smaato.net	1 redirects
1	tags.inzynk.io	assets.adobedtm.com
1	snap.licdn.com	www.fortinet.com
1	static.ads-twitter.com	www.fortinet.com
1	dx.mountain.com	www.fortinet.com
1	i.simpli.fi	tag.simpli.fi
1	cdn.jsdelivr.net	abm-tracking.demandscience.com
1	metrics.fortinet.com	www.fortinet.com
1	pixel.mathtag.com	www.fortinet.com
1	tmp.argusplatform.com	www.fortinet.com
1	trk.techtarget.com	www.fortinet.com
1	api.omappapi.com	a.opmnstr.com
1	a.omappapi.com	a.opmnstr.com
1	ad.doubleclick.net	www.fortinet.com
1	a.opmnstr.com	assets.adobedtm.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	wave.outbrain.com	amplify.outbrain.com
1	fortinet.tt.omtrdc.net	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	www.fortinet.com
1	tag.simpli.fi	assets.adobedtm.com
1	j.6sc.co	www.fortinet.com
1	geolocation.onetrust.com	cdn.cookielaw.org
0	webtracker.argusplatform.com Failed	tmp.argusplatform.com
0	pixels.argusplatform.com Failed	tmp.argusplatform.com
231	92

This site contains links to these domains. Also see Links.

Domain
forums.ivanti.com
www.horizon3.ai
www.cisa.gov
www.rapid7.com
www.fortiguard.com
www.linkedin.com
www.x.com
www.youtube.com
www.instagram.com
www.facebook.com
fortiguard.com
community.fortinet.com
investor.fortinet.com
onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-16` - `2025-07-15`	a year	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
script.crazyegg.com Cloudflare Inc ECC CA-3	`2024-08-02` - `2024-12-31`	5 months	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-14` - `2024-12-14`	a year	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google-analytics.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
a.opmnstr.com R10	`2024-09-21` - `2024-12-20`	3 months	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-27` - `2025-09-25`	a year	crt.sh
*.doubleclick.net WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-06-30` - `2025-07-30`	a year	crt.sh
a.omappapi.com R10	`2024-09-21` - `2024-12-20`	3 months	crt.sh
omappapi.com WE1	`2024-10-12` - `2025-01-10`	3 months	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
abm-tracking.demandscience.com R10	`2024-10-13` - `2025-01-11`	3 months	crt.sh
tmp.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
*.mathtag.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-04-23` - `2025-04-30`	a year	crt.sh
*.google.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
metrics.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-26` - `2025-01-25`	a year	crt.sh
ibc-flow.techtarget.com WR3	`2024-08-28` - `2024-11-26`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
intentstream.contanuity.com E5	`2024-10-14` - `2025-01-12`	3 months	crt.sh
*.mountain.com Go Daddy Secure Certificate Authority - G2	`2024-05-23` - `2025-06-24`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M03	`2024-08-09` - `2025-09-06`	a year	crt.sh
*.inzynk.io Amazon RSA 2048 M02	`2024-01-07` - `2025-02-04`	a year	crt.sh
44.212.189.233 Sectigo RSA Domain Validation Secure Server CA	`2024-01-26` - `2025-02-15`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-07-27` - `2024-10-25`	3 months	crt.sh
siteimproveanalytics.com WE1	`2024-10-17` - `2025-01-15`	3 months	crt.sh
t.co E5	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-07` - `2025-10-06`	a year	crt.sh
tracking.contanuity.com R11	`2024-09-11` - `2024-12-10`	3 months	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-08-21` - `2024-11-19`	3 months	crt.sh
*.global.r1.siteimproveanalytics.io Amazon RSA 2048 M02	`2024-09-02` - `2025-10-01`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Frame ID: 61B42C2D576E3FF70A51CE47B34A2ED2
Requests: 223 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 77DF4ECE2B5E4F4814972CF77B2641F2
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=2122270218.1729241111;ps=1;pcor=722495477;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Frame ID: 312A9CBCCBDFC75106C7C5549A6445B0
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/662878185?random=1729241111343&cv=11&fst=1729241111343&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 0B04F42F2B0880BFE9AA086A922660C5
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/609297413?random=1729241111397&cv=11&fst=1729241111397&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ah0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 32DCB269340FE27B69E5592D94DBD283
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/729495989?random=1729241111464&cv=11&fst=1729241111464&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ah0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 5F819D3FD92BA3297E5C6DAA2B1A862D
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=CKLNhZLFl4kDFX-jgwgdSLcAQw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Frame ID: DC9DEFFC0120E350EE847FE097501435
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA | FortiGuard Labs

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

FingerprintJS (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/fingerprintjs@(\d)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

231
Requests

84 %
HTTPS

37 %
IPv6

62
Domains

92
Subdomains

73
IPs

2
Countries

6432 kB
Transfer

9995 kB
Size

125
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190?language=de
Title: CVE-2024-8190

Search URL Search Domain Scan URL

URL: https://www.horizon3.ai/attack-research/cisa-kev-cve-2024-8190-ivanti-csa-command-injection/
Title: the details

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
Title: here

Search URL Search Domain Scan URL

URL: https://www.rapid7.com/blog/post/2024/01/11/etr-zero-day-exploitation-of-ivanti-connect-secure-and-policy-secure-gateways/
Title: here

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/threat-signal-report/5556
Title: https://www.fortiguard.com/threat-signal-report/5556

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/encyclopedia/ips/56651
Title: https://www.fortiguard.com/encyclopedia/ips/56651

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.x.com/Fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fortinet/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://community.fortinet.com/
Title: Fortinet Community

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 88

https://cm.everesttech.net/cm/dd?d_uuid=34358979600019794372491219540831009332 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZxIgFwAAAJVntwOF

Request Chain 164

https://secure.adnxs.com/px?id=1773420&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Request Chain 165

https://ib.adnxs.com/seg?add=36113683 HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Request Chain 167

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=6BB12C5AB7134149BD3FA0941DCF4618 HTTP 302
https://sync.outbrain.com/cookie-sync?p=smaato&initiation=partner&uid=f1c15edd4b&gdpr=0&gdpr_consent=

Request Chain 168

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/6BB12C5AB7134149BD3FA0941DCF4618

Request Chain 169

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=6BB12C5AB7134149BD3FA0941DCF4618&dongle=yf3 HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=6BB12C5AB7134149BD3FA0941DCF4618&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

Request Chain 170

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=6BB12C5AB7134149BD3FA0941DCF4618

Request Chain 171

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=6BB12C5AB7134149BD3FA0941DCF4618 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=6BB12C5AB7134149BD3FA0941DCF4618

Request Chain 172

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=6BB12C5AB7134149BD3FA0941DCF4618 HTTP 302
https://d.agkn.com/pixel/10751/?che=1729241112742&ip=208.252.80.112&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D214280605039006788556 HTTP 302
https://um.simpli.fi/aa_px?sk=214280605039006788556 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 173

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=6BB12C5AB7134149BD3FA0941DCF4618 HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=6BB12C5AB7134149BD3FA0941DCF4618&ckls=true&ci=aULjUBa2IT&nc=false&trid=2047662310

Request Chain 174

https://um.simpli.fi/pubmatic HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:6BB12C5AB7134149BD3FA0941DCF4618

Request Chain 175

https://um.simpli.fi/freewheel HTTP 302
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=6BB12C5AB7134149BD3FA0941DCF4618

Request Chain 176

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=6BB12C5AB7134149BD3FA0941DCF4618;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=6BB12C5AB7134149BD3FA0941DCF4618;mimetype=img;sr HTTP 302
https://cms.analytics.yahoo.com/cms?partner_id=DATCS HTTP 302
https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS HTTP 302
https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-zdfmSYNE2pQwJggtR1GwOBUDLa7UNgQQihg-~A

Request Chain 177

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=6BB12C5AB7134149BD3FA0941DCF4618&j=0 HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=6BB12C5AB7134149BD3FA0941DCF4618&j=0&xl8blockcheck=1

Request Chain 178

https://um.simpli.fi/yahoo HTTP 302
https://ups.analytics.yahoo.com/ups/55964/sync?uid=6BB12C5AB7134149BD3FA0941DCF4618 HTTP 302
https://ups.analytics.yahoo.com/ups/55964/sync?uid=6BB12C5AB7134149BD3FA0941DCF4618&verify=true

Request Chain 179

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=6BB12C5AB7134149BD3FA0941DCF4618

Request Chain 180

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=6BB12C5AB7134149BD3FA0941DCF4618

Request Chain 181

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=6BB12C5AB7134149BD3FA0941DCF4618 HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=6BB12C5AB7134149BD3FA0941DCF4618

Request Chain 182

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=6BB12C5AB7134149BD3FA0941DCF4618 HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=6BB12C5AB7134149BD3FA0941DCF4618&dnr=1

Request Chain 183

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=6BB12C5AB7134149BD3FA0941DCF4618 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogNkJCMTJDNUFCNzEzNDE0OUJEM0ZBMDk0MURDRjQ2MTgQABoNCJjAyLgGEgUI6AcQAEIASgA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=05a167ef6299c10fa7a518c200f32b9909d4cc4f970568cfdd44ce6e54587f77791426b5417dce21&_=2 HTTP 307
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=05a167ef6299c10fa7a518c200f32b9909d4cc4f970568cfdd44ce6e54587f77791426b5417dce21&rand=07530530

Request Chain 184

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1729241112286&cv=7&fst=1729241112286&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1770566127&cv=7&fst=1729241112286&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybEC&pscrd=IhMIuOKBksWXiQMVOQpoCB2_-ivuMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=1770566127&cv=7&fst=1729241112286&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybEC&pscrd=IhMIuOKBksWXiQMVOQpoCB2_-ivuMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfLAZZH8rSL1bFL5LFLZP4UC7gFTDiYtnf1GSe-d-luKdFlw5f&random=2274644096

Request Chain 186

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=6BB12C5AB7134149BD3FA0941DCF4618

Request Chain 187

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=6BB12C5AB7134149BD3FA0941DCF4618&expires=365

Request Chain 188

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=6BB12C5AB7134149BD3FA0941DCF4618 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=6BB12C5AB7134149BD3FA0941DCF4618

Request Chain 189

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_gid=CAESEJiRPsk-oTHw5hhSjUO3fqs&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6BB12C5AB7134149BD3FA0941DCF4618 HTTP 302
https://um.simpli.fi/g_match?id=

Request Chain 194

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&li_adsId=2b304801-fe70-4b41-83fe-8d03338a6e3b&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&li_adsId=2b304801-fe70-4b41-83fe-8d03338a6e3b&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%252C6313418%26time%3D1729241112576%26li_adsId%3D2b304801-fe70-4b41-83fe-8d03338a6e3b%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%2523new_tab%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&li_adsId=2b304801-fe70-4b41-83fe-8d03338a6e3b&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&li_adsId=2b304801-fe70-4b41-83fe-8d03338a6e3b&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cookiesTest=true&liSync=true&e_ipv6=AQILJL6cRuDLqgAAAZKezWHvuJNqnjloysc4GVbaXZdf8g_IMtXkN7NY53KoyrmB7lJJINWUcIY

Request Chain 195

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa HTTP 302
https://10104846.fls.doubleclick.net/activityi;dc_pre=CKLNhZLFl4kDFX-jgwgdSLcAQw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Request Chain 216

https://idsync.rlcdn.com/395886.gif?partner_uid=3647789467281391627 HTTP 307
https://ml314.com/csync.ashx?fp=d095780446aa7b529920a94aed4c7fed5862c83b621884cae81f4bff5b0bc893f4cb09cee1a4f8eb&person_id=3647789467281391627&eid=50082

Request Chain 217

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=bf1695df-b56f-461e-9ce8-bca196ab62dd&gdpr=0&gdpr_consent=

Request Chain 218

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3647789467281391627%26eid=2 HTTP 302
https://ml314.com/csync.ashx?fp=8373965572602634997&person_id=3647789467281391627&eid=2

Request Chain 219

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2gwHGZWm4U_RW2tdlfKEHEQasb4vZib_v9_QXfCyVzSU&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

Request Chain 220

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d6537317bffb3b903736e7239c156559_1729241112418 HTTP 303
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d6537317bffb3b903736e7239c156559_1729241112418&_bee_ppp=1 HTTP 303
https://tracking.contanuity.com/usersync?bwcookie=AAN3W07OJEAAABsbq2fDhQ

Request Chain 227

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=4b71ab47-8d2d-11ef-88ff-d5a1d54a5160&gdpr=&gdpr_consent= HTTP 302
https://px.steelhousemedia.com/tdsync?tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd&shguid=4b71ab47-8d2d-11ef-88ff-d5a1d54a5160

Request Chain 228

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=bf1695df-b56f-461e-9ce8-bca196ab62dd&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=8373965572602634997&ttd_tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YmYxNjk1ZGYtYjU2Zi00NjFlLTljZTgtYmNhMTk2YWI2MmRk&gdpr=0&gdpr_consent=&ttd_tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd&google_gid=CAESENYEXxEFzQm-ulmYBoP0Iks&google_cver=1 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=bf1695df-b56f-461e-9ce8-bca196ab62dd&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=bf1695df-b56f-461e-9ce8-bca196ab62dd&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad HTTP 302
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D2c4539d9-151c-427f-825b-81eed58693d5%252Chttps%25253A%25252F%25252Fmatch.adsrvr.org%25252Ftrack%25252Fcmf%25252Fgeneric%25253Fttd_pid%25253Dtapad%252C HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=8373965572602634997&pt=2c4539d9-151c-427f-825b-81eed58693d5%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%252Fgeneric%253Fttd_pid%253Dtapad%2C HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad

231 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa Show response
www.fortinet.com/blog/threat-research/ 143 KB
35 KB 165ms
48ms Document
text/html 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

2118826227dcf56e102ae9e89af0ba303aee0bc45ae1bfc4e4d29b1246ce58fb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Age: 63726
Cache-Control: max-age=600, public, s-maxage=10800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 33820
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Type: text/html;charset=utf-8
Date: Fri, 18 Oct 2024 08:44:54 GMT
ETag: "23ac2-624ad7bac1466-gzip"
Last-Modified: Thu, 17 Oct 2024 15:03:03 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
X-Amz-Cf-Id: O8AYacuHJhNCDuSxs3AEpvpzyIYa0PEC3jpi195IkkBeUZCKbkjQJw==
X-Amz-Cf-Pop: IAD61-P2
X-Cache: Hit from cloudfront
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1-28559771
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK visitorapi.min.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 64 KB
30 KB 81ms
33ms Script
application/javascript 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "fe2d-6117284c96900-gzip"
Age: 41906
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: g7t1W6R0FvH1tPrp0GqYg7T8ct_tfA-JMGq03mT3BCj1ZdYUPoprdA==
Date: Thu, 17 Oct 2024 21:08:02 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 15 Feb 2024 21:43:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29532
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK at.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 104 KB
48 KB 120ms
35ms Script
application/javascript 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "19e83-61431fc4b24c0-gzip"
Age: 41827
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 1AKsC4PpkVu39O9ffhts0WZZ7dHDJfTJbRet1bD7iks4pBJCx1UwCA==
Date: Thu, 17 Oct 2024 21:08:02 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 21 Mar 2024 20:59:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47782
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 540 KB
28 KB 36ms
33ms Stylesheet
text/css 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "86e1b-61b58998583c0-gzip"
Age: 1251253
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: hAn4KuvbuccuDalOVGaLrHA4Km-JIXqX_WSeSiiLBSV8UWlsJObpig==
Date: Fri, 18 Oct 2024 08:44:07 GMT
Content-Type: text/css;charset=utf-8
Last-Modified: Thu, 20 Jun 2024 21:00:07 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27478
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 153ms
49ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: uiXk8gw/ehyoMvZ3GeQiaQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCEDAD087F157F
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 43277
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 08:45:09 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 06:37:40 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ca0be203-601e-00f9-010e-20596a000000
cf-ray: 8d474028f986330c-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7214
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 131ms
46ms Image
image/svg+xml 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 36445428
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Yrd-VKUWQxDVX0ptE7kh8EU1huMfkOw2rmZpn63ErANNtqDtoXCXRg==
Date: Fri, 18 Oct 2024 08:44:07 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
3 KB 134ms
46ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4fd-60a2031eb4f40"
Age: 29257845
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: VpoaDoRbvBJ2Fp6X9PNL1t2p5V_2odzat5VXxR240vavIJrcE-1j0w==
Date: Fri, 18 Oct 2024 08:44:54 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 160 KB
74 KB 34ms
34ms Script
application/javascript 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "28100-61cff12ce1d80-gzip"
Age: 1251248
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: OpDdh1D0iS0D8eVPdu_pweJzjDbUNwPeLa6WAWhLIgszgTaphCnTHQ==
Date: Fri, 18 Oct 2024 08:43:52 GMT
Content-Type: application/javascript;charset=utf-8
Vary: Accept-Encoding
Last-Modified: Thu, 11 Jul 2024 21:01:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 74768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 5 KB
2 KB 187ms
94ms XHR
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Uj3iBUKm1Vl2g2NHq67V+w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF23DF5130
age: 50896
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 19 Oct 2024 08:45:10 GMT
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/json
last-modified: Thu, 28 Dec 2023 19:56:54 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 67257c4e-101e-0033-60c8-396628000000
cf-ray: 8d474029dff243ee-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1792
x-ms-blob-type: BlockBlob
server: cloudflare

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK ivanti-hero.jpg
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 220 KB
222 KB 32ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/ivanti-hero.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

18041a7dd2be9d4ba5469edca86d5bd763e3bdcae7a83c5559c618bf4be83f0f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3715e-6242cd5d60d40"
Age: 572887
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: vdBrNDtHniKfqVBXKrXU11iWeQ26IJG8UqQzSMtTy6qBrz1bip7NDQ==
Date: Fri, 18 Oct 2024 03:49:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:34:05 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 225630
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK siemens-vuln-discovery-center-thumb.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 146 KB
147 KB 34ms
33ms Image
image/png 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/siemens-vuln-discovery-center-thumb.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b3f4fd3661f04c2c6374215073e85cb8c5c938ee783677f40e85151989c39d97

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "24631-5e417b82eaa40"
Age: 36442377
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: g1svZkjIS5FGQXKwcbthe4YD8DUMxul55JmHGVRsRhGwtdaemrLSvg==
Date: Fri, 18 Oct 2024 08:44:55 GMT
Content-Type: image/png
Last-Modified: Mon, 18 Jul 2022 17:30:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 149041
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ransomware-roundup-thumb.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 142 KB
144 KB 36ms
35ms Image
image/png 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/ransomware-roundup-thumb.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

727d19bf895438013bb188825e546dd6e61f80c2a4ea8e7b6e978b96bab546f4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "23995-5e41c8188d9c0"
Age: 36444316
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: J2fbu4PSN5NZB2EgUcHfoaQtBj13lf3JY15wTRV_9XHGlkQ8RcMzmg==
Date: Fri, 18 Oct 2024 08:44:55 GMT
Content-Type: image/png
Last-Modified: Mon, 18 Jul 2022 23:12:47 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 145813
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK MOVEIT-THUMB.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 124 KB
126 KB 38ms
37ms Image
image/png 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/MOVEIT-THUMB.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

443f47f0ae01cec5b4bc117dffb451485e147a54865efa7c820320e68cb55909

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1f0d8-5fd8fff10e040"
Age: 36444365
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zkQASCjrT5FxvT3S7vLPGUAbPn87RVy2YOCxPBSziZmtybFfZ-nFNw==
Date: Fri, 18 Oct 2024 08:44:55 GMT
Content-Type: image/png
Last-Modified: Wed, 07 Jun 2023 20:29:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 127192
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
38 KB 42ms
41ms Font
application/octet-stream 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Response headers

X-Vhost: publish
ETag: "9354-5df4fa74ff980"
Age: 41828
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: DTPkgeX6Y-dXvpqWDVtPpCJqLHEE5hoMGHuTMxEpcglkMoWLi4_63w==
Date: Thu, 17 Oct 2024 21:18:12 GMT
Content-Type: application/octet-stream
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37716
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 69 B
305 B 168ms
84ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59e58524340cd7ad353be010374b124c242fdde10a0ed41047fe2fd4bb9e5a2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8d47402b1ef14caf-PHL
access-control-allow-origin: *
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK ivanti-web-request-client-index.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1728620161388/ 46 KB
47 KB 34ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1728620161388/ivanti-web-request-client-index.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

26b37b2982358112ad578340484a7de6274a19db3fb6ea13f0b4e2d89e35f566

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "b76f-6242bbea5e240"
Age: 280486
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: HnwGtY1vEOSO73whdlt4p8ZqZ5SiOBblu4kpR3mjAcmfKJT-N5sSfA==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 46959
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig01-ivanti-gui-dl-landesk.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1172236801.img.jpeg/1728620210875/ 93 KB
94 KB 35ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1172236801.img.jpeg/1728620210875/fig01-ivanti-gui-dl-landesk.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

1d3e1ffd86a5653412775034689e08d77352a1a255038f3cf953b76318ac946a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1733a-6242bc1919080"
Age: 280486
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: DMgzFrcKhO6ub1HabSOoxYQZEU4RZkLEzPheaLreETNtwGw4j_F-RQ==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:16:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 95034
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig02-ivanti-redirection-download.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2006588417.img.jpeg/1728620263874/ 15 KB
16 KB 36ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2006588417.img.jpeg/1728620263874/fig02-ivanti-redirection-download.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

933ddaeb7b389ab0803e3e7a1124cd51dcd097514e5e1cff4d4cef50b219779e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3bfd-6242bc4ba47c0"
Age: 280486
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: rvSv2XOTgOAd7nGUUU5jHqGO5nQNohrxR9JuVNGptts0dV75kV1bJw==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:17:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 15357
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig03-ivanti-redirection-ondemand.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_184115790.img.jpeg/1728620317634/ 8 KB
9 KB 37ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_184115790.img.jpeg/1728620317634/fig03-ivanti-redirection-ondemand.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

17095b0dfaded492b73f4f6a30412ecb2f7a87a2ebd1f8963d5c5cee3db937bd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2011-6242bc7f24140"
Age: 280486
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: FJJoqNdG1sQOiXObkVnpMUjcDDt1cazfjeRc6bkGSHSkldS1g7siTw==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:18:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 8209
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig04-ivanti-code-vulnerable.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_853574561.img.jpeg/1728620365076/ 44 KB
46 KB 41ms
35ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_853574561.img.jpeg/1728620365076/fig04-ivanti-code-vulnerable.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

80979b936a389e029f1d96f9b57e39257416add377d59a14c91708c48cc60ae2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "b104-6242bcacead40"
Age: 280485
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 19UKRWInQk7Cs6qtAa_6drGd9NqSNjLt_BIGqbJhSET8F_G5JOyB7Q==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:19:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 45316
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-client-index-gsb-users.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_870303825.img.jpeg/1728620426185/ 17 KB
18 KB 43ms
37ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_870303825.img.jpeg/1728620426185/ivanti-client-index-gsb-users.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f53109bc9c1f5eba5a8e47a82b8a8e12de6fdd2c81f0a5320d5cd457708a5324

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "43b0-6242bce717680"
Age: 280269
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ejnQ04ytzVi9n15aJqD1emBhXWlNfGgZ6Z0KYoGgUzdp_Y23HmS2Tg==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:20:26 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 9a7233ae68a3338294c89b1bf53bc426.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 17328
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig05-ivanti-path-traversal.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1543583598.img.jpeg/1728620510929/ 59 KB
60 KB 32ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1543583598.img.jpeg/1728620510929/fig05-ivanti-path-traversal.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

cbe67b5b6fa27d2f9d4f18dba4f940ce8c4a3dbcab1541b5b1023ce4dcea66e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "ebd4-6242bd3733380"
Age: 280485
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 8ZRlaxpD6EY7ju9sqIkbe6lThm_kxR15kPduJlSnMtHItrPFlk9uOg==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:21:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 60372
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig06-ivanti-path-traversal-vulnerability.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1413617697.img.jpeg/1728620553579/ 126 KB
127 KB 31ms
31ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1413617697.img.jpeg/1728620553579/fig06-ivanti-path-traversal-vulnerability.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a364f8998ea88f243a482109d256626e8d7cb72a05eac69ac608c27435241a65

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1f626-6242bd6035440"
Age: 280441
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: lA4AiV3I25NkVQOxYN5-kL5Zufb_QOizh9Cv7zO6S96HHTgHXhlGrA==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:22:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 128550
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-csa-management-console.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2028077941.img.jpeg/1728620592057/ 31 KB
32 KB 31ms
31ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2028077941.img.jpeg/1728620592057/ivanti-csa-management-console.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d4edec0e6d150110e180ad38f47e5eab79358d5df97f12e15c73a4b538863451

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ada-6242bd8566c00"
Age: 280485
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: VqtGG9-Ke70omhMqcwYR4SOlFuPhOGLhkHSZYClNG1F_usn1kI8B6Q==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:23:12 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31450
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig07-ivanti-sqli-vulnerabilty-exploitation.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_288801384.img.jpeg/1728620655617/ 173 KB
174 KB 33ms
33ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_288801384.img.jpeg/1728620655617/fig07-ivanti-sqli-vulnerabilty-exploitation.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

ad15ab06d640d365a00d41e146660addb01348b2f6878f6ffdc1dc428c67cc19

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2b2af-6242bdc17b9c0"
Age: 280484
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 04E7cXFE-yShhR2Tx30r2qBgF-qVHxRcXz-AxP72HoAMC61vxSD1Sg==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:24:15 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 176815
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig08-ivanti-setting-timezone-value.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_512758081.img.jpeg/1728620707132/ 25 KB
26 KB 32ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_512758081.img.jpeg/1728620707132/fig08-ivanti-setting-timezone-value.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0e6e31465592638aaa036384d85ebd6e6c56b9178591bceea4a0b815dd06d535

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "6205-6242bdf312ec0"
Age: 280438
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 2ZVkoa3EDKBOw77pMNdihVX3sjwVh2Cv8wvsvszfJayV_e_Ht4uYWw==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:25:07 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 25093
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig09-ivanti-vulnerabie-function.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_156964748.img.jpeg/1728620764864/ 29 KB
31 KB 31ms
31ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_156964748.img.jpeg/1728620764864/fig09-ivanti-vulnerabie-function.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

7c37b5d2c568700acb5aa4d6fc9ece9bc0df8882dc473d944a854ade711a696c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "758d-6242be296ef00"
Age: 280438
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 1z6gjr8b3c7dBLfOvfo22_swM7yagJIQHTI7O4Yh0FHAoRWAWsdklA==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:26:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 30093
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig10-ivanti-time-zone-change.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_546641334.img.jpeg/1728620805020/ 58 KB
59 KB 32ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_546641334.img.jpeg/1728620805020/fig10-ivanti-time-zone-change.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

ec5a240780ab83205367dfb9274a408269d2a10d837164fe39eebabd757d9e7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "e618-6242be5088b40"
Age: 280441
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Jwc6j7CmJZaYBMb-1DYJQLZw_03-1mbS9rBcL8S0V5ilIqTSTxjtPw==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:26:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 58904
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig11-ivanti-post-variable-timezone.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_879745814.img.jpeg/1728620849864/ 87 KB
89 KB 33ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_879745814.img.jpeg/1728620849864/fig11-ivanti-post-variable-timezone.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f21e3a5a80821feb91e7bb84d525742fd137c4b336f3ff3f1bb15dc2fcae9d70

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "15d27-6242be7a7ee40"
Age: 280484
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: -bR3_1ldV_yFiG8xjAkScmz9R77DtpKP1iXYwl8qTbYXTaBhuEvcSg==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:27:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 89383
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig12-ivanti-decoded-base64.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1686730515.img.jpeg/1728620888293/ 112 KB
114 KB 31ms
31ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1686730515.img.jpeg/1728620888293/fig12-ivanti-decoded-base64.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8af6fb23ba1c0a4860476b240ba2d05c02ff018f1a93d2caadf7301ed87223d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1c1e7-6242be9fb0600"
Age: 280438
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: s6K6QONLkxXzPbBmpliP4B3lfhdAF7lmUclh9MlU-CErC1o1-Izadg==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:28:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 115175
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig13-ivanti-broker-conf.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_658029349.img.jpeg/1728620938935/ 31 KB
32 KB 31ms
31ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_658029349.img.jpeg/1728620938935/fig13-ivanti-broker-conf.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0968bbb30f1aef951bb770793756fca4fd75cce26bce318ace9c6e31deddf7f6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ab8-6242becf5f680"
Age: 280483
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: gZpNB6IFIKNchJuc6HNWL_0iN6bSYYVsbJPS23TKNf4HjicX2BdwvQ==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:28:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31416
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig14-ivanti-root-user-private-key.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_669364972.img.jpeg/1728620991417/ 11 KB
13 KB 32ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_669364972.img.jpeg/1728620991417/fig14-ivanti-root-user-private-key.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bd6f701d7b3abd41679f87c496bc8911a602f247900dfc7ab7cb3a62abe098ee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2cda-6242bf01eadc0"
Age: 280483
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 2rdhe-exPZM951n60eVuRpJG35Tu07dfajIjsaLZh-gBQEVb2AhHVg==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:29:51 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 9a7233ae68a3338294c89b1bf53bc426.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 11482
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig15-ivanti-postgres-database.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_801722592.img.jpeg/1728621025851/ 96 KB
98 KB 31ms
31ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_801722592.img.jpeg/1728621025851/fig15-ivanti-postgres-database.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b69b5763c6c912b8a1852981c4401647963d63734e234b073d97c0dffbf64206

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "180ac-6242bf2257a40"
Age: 280483
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: W2OR6NYhKUPe8lKkPhZA3DAN_BFK5fogr8nfSsmXgEc0G4NvLERIhg==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:30:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 98476
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig16-ivanti-command-injection.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841058103.img.jpeg/1728621069609/ 111 KB
112 KB 35ms
34ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841058103.img.jpeg/1728621069609/fig16-ivanti-command-injection.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

cff43ffcd3d9feaba4fb1250d800a3b9650a7f65c26f00b196e403cc763ee1d4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1bbea-6242bf4c4dd40"
Age: 280483
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: oeXgQNu0kzE6f2malf0m3LYu4JzMgSgBoAfWQpenKAy4Vsx1TLkqbQ==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:31:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 113642
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-malicious-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1382954794.img.jpeg/1728621104113/ 16 KB
17 KB 34ms
33ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1382954794.img.jpeg/1728621104113/ivanti-malicious-command.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d3cdd8255b0cabf4568ec33c19f12ef6a3a761ea27bb36f0e1a12d9c4f31a2f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3ec2-6242bf6daec00"
Age: 280483
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: WbjvYCie3EMTOHxf8dIIGSegsNCyta1_GyqRdhG_JOr5sRO2Sr5kIQ==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:31:44 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 16066
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig17-ivanti-command-injected.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_611292844.img.jpeg/1728621139581/ 18 KB
19 KB 32ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_611292844.img.jpeg/1728621139581/fig17-ivanti-command-injected.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f797f871bec64d4d54308abab8c7008df6b855a83b59dbc17665e3c4111e7032

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4858-6242bf8f0fac0"
Age: 280481
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: KldF97H3-dbLFlSBK90DEZr1w1D-QNySpz-ESiTiAHLReurbbn1JAw==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:32:19 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 18520
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig18-ivanti-code-vulnerable.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_115137765.img.jpeg/1728621184124/ 70 KB
71 KB 32ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_115137765.img.jpeg/1728621184124/fig18-ivanti-code-vulnerable.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

c584b5d0f98a654a3857877fa1e3dbb85b0b0e779191ad952af4e14116205e2c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "11771-6242bfb9fa000"
Age: 280482
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: CE9LBNuuIJCLKkhoZSWMtI2aHLwWzE28KNXVnOePBNCapzv87sjICA==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:33:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 71537
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig19-ivanti-update-function.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2034876463.img.jpeg/1728621223395/ 55 KB
56 KB 34ms
34ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2034876463.img.jpeg/1728621223395/fig19-ivanti-update-function.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

5cde97a99252b4ad4fa0d3becd808a64e2b1946feef502515a47aab3f9110f7c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "da41-6242bfdf2b7c0"
Age: 280482
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: yD2Jbtqq9cGFo5gE8E-c3BrgmWIHYzmGG4CmSowOfcc6BPXA3-lieg==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:33:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 9a7233ae68a3338294c89b1bf53bc426.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 55873
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig20-ivanti-files-patch.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_450058568.img.jpeg/1728621256835/ 87 KB
88 KB 33ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_450058568.img.jpeg/1728621256835/fig20-ivanti-files-patch.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a9a345b743fb7460be8d7e10ca085ea57901980b67d43151196d36f94a5451cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "15a79-6242bffea4200"
Age: 280482
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 69VxnaDyQK5uKGB2lITXJfILsKxKKEHMiEP5X2w3pfmamq9jsowFlA==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:34:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 88697
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig21-ivanti-patch-script.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1942091345.img.jpeg/1728621289333/ 101 KB
103 KB 33ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1942091345.img.jpeg/1728621289333/fig21-ivanti-patch-script.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

36186e198e296c76785020a85f35312fbf538fe48f96b8358b01c25cb5b673e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1958b-6242c01e1cc40"
Age: 280482
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: mWv9ERSYDMz-gN-Sz5k9tyj6rtoanB-zh87-AnhYQKwBVdSROtuoWQ==
Date: Thu, 17 Oct 2024 15:12:25 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:34:49 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 103819
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-temp-tmp-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_479439523.img.jpeg/1728621332478/ 29 KB
30 KB 33ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_479439523.img.jpeg/1728621332478/ivanti-temp-tmp-command.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

18f5794db26670e34d8df06806be8536dc6520a380dcf67bced51fc8f7ef91e1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "73b9-6242c0471ed00"
Age: 280482
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: n-EIfar0ohSGGnUUm6gbi3X93we4fHNniioj0buf4jAWwfwSP8jdOw==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:35:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29625
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig22-ivanti-patch-timestamp.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_280612408.img.jpeg/1728621400402/ 22 KB
24 KB 33ms
33ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_280612408.img.jpeg/1728621400402/fig22-ivanti-patch-timestamp.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

4aa70a752741f88840c0ae6612f71b6220ac77080c263caa1682cee47d9b39da

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "59be-6242c087f8600"
Age: 280482
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: _WRA6XeawRvTEVqEqLKffzPgyguNkCENTESuRY04WHHt3TxitiYc-g==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:36:40 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 22974
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig23-ivanti-patch-timestamp-datetimetab.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1121393809.img.jpeg/1728621473905/ 15 KB
16 KB 34ms
34ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1121393809.img.jpeg/1728621473905/fig23-ivanti-patch-timestamp-datetimetab.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

643a52fac3e3aae163ef76ad0a2a088d2f31ac2552eff000edc1b495c8fbba32

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3c34-6242c0cd96a40"
Age: 280481
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: hpo66PwqQtsv9D8gEvBGFCjt0FNhkJMgs8C1yfX5o6-n3jVwnC6W8A==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:37:53 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 15412
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig24-ivanti-comparison-code.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1656384028.img.jpeg/1728621510804/ 93 KB
94 KB 33ms
33ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1656384028.img.jpeg/1728621510804/fig24-ivanti-comparison-code.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8ef9e9b7103e38d4509a125612dad3ff98edfd671fa45f01d4d09c3cefa50a8f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1737c-6242c0f0dfd80"
Age: 280481
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 0gLWeTq0VIRaefl1Ww6j_Z6YigEfTB_8d7E0l7MVsSX-5ncyAxspTQ==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:38:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 95100
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig25-ivanti-exploitation-testing.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1136962043.img.jpeg/1728621561290/ 129 KB
130 KB 32ms
31ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1136962043.img.jpeg/1728621561290/fig25-ivanti-exploitation-testing.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bb13a80fdd4875e6626de9e2b4ebf7948f3cfe191f73b4dbf31e1247d0239667

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "20339-6242c12183040"
Age: 280481
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: nx_rEwK8cFK8VO7Q_H1K51j-5wxxdGJBJ0semTkWnzd2hlNCRtj96Q==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:39:21 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 131897
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig26-ivanti-testing-command-injection.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1958099435.img.jpeg/1728621691327/ 107 KB
108 KB 32ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1958099435.img.jpeg/1728621691327/fig26-ivanti-testing-command-injection.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bec3437c8baa45a6344648c2bb6806831972c5cdd7ae34a16897d6e205092476

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1ab81-6242c19d7d4c0"
Age: 280481
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 3_z-Fk30pnyTt1AyoeEh5os73RubEosc-_eE7pWNXlkqogJDVRlzfA==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:41:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 109441
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-sample-malicious-post.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2136686996.img.jpeg/1728621736636/ 65 KB
66 KB 32ms
31ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2136686996.img.jpeg/1728621736636/ivanti-sample-malicious-post.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

1a8491dacfaed6de53e20ff200c81255fb61def72f2696426a23ec5a05265b28

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10408-6242c1c867a00"
Age: 280481
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 8jg6-ah3nm3z0YtISqkPYlLnwqfLEivSgpABfiv2Qj8PONdFtqrIaQ==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:42:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 66568
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-sqls-remote-code-execution.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_958399012.img.jpeg/1728621780661/ 89 KB
90 KB 35ms
34ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_958399012.img.jpeg/1728621780661/ivanti-sqls-remote-code-execution.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d5dc4157271c9d3147055b0f2b85578271417af24cb1cfd197b84194ddaa0bfa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "16350-6242c1f25dd00"
Age: 280480
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 21hnIfdBiwMrw2ZD5MvN5BNjnibHU_8XYrSfz2qgdZgNL8Gydxllxg==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:43:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 9a7233ae68a3338294c89b1bf53bc426.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 90960
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK table01-ivanti-threat-actor-commands.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_133352251.img.jpeg/1728621923615/ 50 KB
51 KB 89ms
89ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_133352251.img.jpeg/1728621923615/table01-ivanti-threat-actor-commands.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

717f11c79608856a33546a50fe20ac984c44c933ba23ea02c851f8f0004df1fd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "c75d-6242c27abdec0"
Age: 280480
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Q3HPfNRR8QdvAvuQSWy1g7mPaat468xiMPvD3ki1cwoqG-3-lQlw4g==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:45:23 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 51037
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-powershell-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1877150742.img.jpeg/1728621963572/ 77 KB
79 KB 83ms
83ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1877150742.img.jpeg/1728621963572/ivanti-powershell-command.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b0b526b901a7afeac92efcd87a441305a26891bba8bfbb950f4b18f7fd582e59

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "134e8-6242c2a0e38c0"
Age: 280480
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: aGZxSxBPw0z3d6YgVUOf2dgOp7qNjABvhTn1EK7FwEyKSfT6mm2N6w==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:46:03 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 79080
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig27-ivanti-content-1log.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1065565645.img.jpeg/1728622001838/ 51 KB
53 KB 39ms
39ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1065565645.img.jpeg/1728622001838/fig27-ivanti-content-1log.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

5fa043f0c7d87051071a76bfcd9a59a537991943ba96fde8cc718c5a0919b45b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "ccf0-6242c2c520e40"
Age: 280480
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Kq9oTysd0uzUHsvv3sAz66hR3pypw7zhh33ygp1iB_4cIjGKSIHrYA==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:46:41 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 52464
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK table02a-ivanti-threat-actor-commands.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_554353955.img.jpeg/1728661138131/ 1003 KB
1004 KB 38ms
37ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_554353955.img.jpeg/1728661138131/table02a-ivanti-threat-actor-commands.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

4af5dacf19bc195010075d202d98f083a444a8572cbc1711fe39225928cb6be1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "faaf9-6243549114880"
Age: 280479
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: BhgeqTYtthAWXehn_ShQQB4en_V_wg7PTVqZW_xyrU1hCPcdDMH8lw==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 15:38:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1026809
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK table03-ivanti-web-shells.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1145145370.img.jpeg/1728622608310/ 80 KB
82 KB 34ms
34ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1145145370.img.jpeg/1728622608310/table03-ivanti-web-shells.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

92cfae0b0d343d93e5e1d365bb9179904e50407d803588ec009e2bb19e211ea3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1416e-6242c50802400"
Age: 280480
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: gw-pDLoBrDP8tvvcqkT0lWu2dwlZGaIE4GP-DACj7KkPLZzuNCVjqg==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:56:48 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 82286
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig28-ivanti-brute-force-tooling.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1202021139.img.jpeg/1728622643931/ 37 KB
38 KB 35ms
35ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1202021139.img.jpeg/1728622643931/fig28-ivanti-brute-force-tooling.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

2e50f9ae9324af2e1d1803215dfa3b1e4476f62bf1c3d548743835992ca87182

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "9326-6242c529632c0"
Age: 280479
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: J41nfeqXt4VQo6Xvx96mMMU0BSA3juQQxbQMGQzo7Ym49EOVy2AlQg==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:57:23 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 9a7233ae68a3338294c89b1bf53bc426.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37670
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig29-ivanti-content.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841266866.img.jpeg/1728622674435/ 23 KB
24 KB 32ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841266866.img.jpeg/1728622674435/fig29-ivanti-content.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

66a9e8a80c33a2f932441adf709f92aecca67782c8c0c5b1e165584d7eb3a291

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "5c88-6242c546f3880"
Age: 280479
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 7zMxQzV594grpJjKIW66lNkGYS8R-SxDvkBbUcNCrw6g-CMiMSqiPg==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:57:54 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 23688
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-csa-appliance.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_16445584.img.jpeg/1728622709083/ 41 KB
42 KB 32ms
32ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_16445584.img.jpeg/1728622709083/ivanti-csa-appliance.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

188c1c4378ca30c9eef2b446a37c4a7eb75d043f56acf32c35eb0077bb8705a6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "a328-6242c56854740"
Age: 280479
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: P5hx38ip1YVm1o22BIuNMmmL4aOVilf7zrbzJDK-cRsvaALkb-WWGQ==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:58:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 41768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-php-variables.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_421608083.img.jpeg/1728622739558/ 35 KB
37 KB 84ms
84ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_421608083.img.jpeg/1728622739558/ivanti-php-variables.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f02faad1987312daa96dcd532794b6db4faa8a623306821b9d26235dbea36983

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "8df4-6242c584f0ac0"
Age: 280479
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: u_GeSZFp4CdNHiqMdBwejZV0F08lKk-M3UQFNVhyfSURShFZWmUktQ==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:58:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 36340
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-linux-kernel.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_38071269.img.jpeg/1728622775542/ 65 KB
66 KB 34ms
33ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_38071269.img.jpeg/1728622775542/ivanti-linux-kernel.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

644e98e4c6ce7519f77dc6c7401426d231c8f895f550c7f6c514bb4ec302ec6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10317-6242c5a745bc0"
Age: 280479
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 3a5dYEejBs4iSs4irZ_1plqauYjKyE-WFo1IkdZDnCdrEKnnnNzrAA==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:59:35 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 9a7233ae68a3338294c89b1bf53bc426.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 66327
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig30a-ivanti-base64.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1621469609.img.jpeg/1728622837198/ 171 KB
172 KB 31ms
31ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1621469609.img.jpeg/1728622837198/fig30a-ivanti-base64.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

39a543197cee3bd0cac857a39467717e59781b5a8eec38ba40ebcc281e2c78b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2ac3e-6242c5e266740"
Age: 280479
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 3QRUwfZhnPPBBM9nuZkSCCn6xEyHu0T-N957eBzOHmJny2OjNgtioQ==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:00:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 175166
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig30b-malicious-tar-file-content.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1244035500.img.jpeg/1728622869372/ 14 KB
16 KB 83ms
83ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1244035500.img.jpeg/1728622869372/fig30b-malicious-tar-file-content.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

61af4356b1a56a808fbe79a6cd0f96444069b54d9eb1a1576b45c0e0f6bae0c5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "38ce-6242c600eaf40"
Age: 280479
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: _I5lqmHfWP4zoSZZORHDT2yIridNhzyjGD60GOC0Cfw6d0CsnUlxiw==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:01:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 14542
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig31-ivanti-rootkit-files.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_460351710.img.jpeg/1728622903847/ 20 KB
21 KB 39ms
39ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_460351710.img.jpeg/1728622903847/fig31-ivanti-rootkit-files.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

17234dc33fee83a6097588da7dc802864fd9af021ff0b48fa73a404e30aa362c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4f8f-6242c62157bc0"
Age: 280478
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 8aEXoht0g1UcSxHt49PSWGRXLcNHW7XaNp1mgo8cwgC-yNgY7PSrdg==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:01:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 20367
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-script-start-param.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1397322820.img.jpeg/1728622948264/ 79 KB
80 KB 33ms
33ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1397322820.img.jpeg/1728622948264/ivanti-script-start-param.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

72a16e82ebbe48c45ef6e2a67f4645444081d0cb72e09324824fc123fc30f6a0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "13afb-6242c64c42100"
Age: 280478
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: oSW5HazgcrNqFiA49VEryYGP8P_jY0lSlB-jmErX-F54Q5rVzzew4Q==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:02:28 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 9a7233ae68a3338294c89b1bf53bc426.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 80635
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-script-second-param.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_281043642.img.jpeg/1728622982349/ 12 KB
14 KB 34ms
33ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_281043642.img.jpeg/1728622982349/ivanti-script-second-param.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f26ae51e214125767e456bc97f886b908749c984035ab7d7432fb11031a2a8e3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "31e8-6242c66caed80"
Age: 280478
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: iwnPsBNyU9FsPagBfqiVCmnd7R1f3TssLTvnJYsig30WSDaBJgiHSw==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:03:02 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 12776
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK ivanti-code-snippet-path-exists.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1062228048.img.jpeg/1728623065236/ 31 KB
32 KB 31ms
30ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1062228048.img.jpeg/1728623065236/ivanti-code-snippet-path-exists.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

872f233ef34c09bfa33644108af6f2dfce8f77a0e2dc0847882840355efc4820

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ad4-6242c6bbd6840"
Age: 280478
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: M514PLfnLBwIBxXgx68sFr-eGigLBPTaNra0EXuiR57FZWaHItX11g==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:04:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 362048055e32798c3baf11d093fb4a46.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31444
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig32-ivanti-installation-malicious-kernel.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_651532223.img.jpeg/1728623117727/ 23 KB
24 KB 83ms
82ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_651532223.img.jpeg/1728623117727/fig32-ivanti-installation-malicious-kernel.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a462bb85392ef235bc0ab080e8a9ae078a228fb74b3df156cb9f3ce7e20ad9e6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "5bd6-6242c6ed6dd40"
Age: 280478
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: LxBN43au1Xc5c37sZ830pMq0RvvKRXG3Zoo6TUeqni_iY6vlxv94BA==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:05:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 23510
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig33-ivanti-establishing-rootkit.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_948091254.img.jpeg/1728623149502/ 67 KB
69 KB 33ms
33ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_948091254.img.jpeg/1728623149502/fig33-ivanti-establishing-rootkit.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

e91d19121fbf6ef08ec7ce270a07ef60a36ee454268228a0d698f666c2d9f359

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10d87-6242c70bf2540"
Age: 280478
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: BRto3yreuiPzN3LDHojSt8hAeDw6ArLrlH1JY2JZ5_hQ_c-p85n39w==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:05:49 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 db190417d0f5689511af25059af21b3a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 68999
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig34-ivanti-rootkit-persistence.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_89044911.img.jpeg/1728623190397/ 57 KB
58 KB 85ms
85ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_89044911.img.jpeg/1728623190397/fig34-ivanti-rootkit-persistence.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

931a1bc91c7b780d9df916bdbd551447e2b0d742a0ff1bdd7a6dbb5f42619b39

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "e339-6242c7330c180"
Age: 280478
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: A266SOTd2u4E13WxZXLM5W2547Zu9803Bavf-sPIpq-kyPrzfQEmlg==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:06:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 58169
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK table04-ivanti-mitre-mapping.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_256695740.img.jpeg/1728661530772/ 94 KB
96 KB 34ms
33ms Image
image/jpeg 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_256695740.img.jpeg/1728661530772/table04-ivanti-mitre-mapping.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a127f5d38a4a71d09b04fe89ab3c7cea05b5d20997a702855f66bcf3c0393cd5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "178fb-62435606eba80"
Age: 280477
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: DqIem_iZZVDAyVIuYc_cc49j9e8MPXqcvoVhBVyOzqyT9llPTEljjg==
Date: Thu, 17 Oct 2024 15:12:26 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 15:45:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 9a7233ae68a3338294c89b1bf53bc426.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 96507
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.10.0/ 356 KB
78 KB 44ms
43ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Bh9exWOPGIwRshWljrtlEw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735260901BC
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 37217
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/javascript
last-modified: Thu, 03 Dec 2020 02:43:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f4887a51-a01e-00a0-1512-205cec000000
cf-ray: 8d47402baa59330c-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 79698
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/ 99 KB
24 KB 48ms
46ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: SDJFQYswktbx6w5cJzzMRQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF2B6F9C71
age: 37555
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 19 Oct 2024 08:45:10 GMT
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/json
last-modified: Thu, 28 Dec 2023 19:57:06 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 9f466969-301e-009d-1cc8-39cb39000000
cf-ray: 8d47402c393143ee-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24004
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 13 KB
4 KB 37ms
37ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: W9e0YobmEbvdB0V9OmpQkw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735209A34D6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 40665
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: e7ba9f8a-a01e-0009-5512-247c50000000
cf-ray: 8d47402ca9c243ee-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3329
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 45 KB
12 KB 57ms
57ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: zNsRoM1FEmsEgJoYMCNTng==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D897352245C4EA
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 54923
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:53 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 77f313b5-301e-0034-7eb4-210a4b000000
cf-ray: 8d47402cc9cc43ee-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11755
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 509 KB
122 KB 135ms
38ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8fa1b5cf3d89f86a6368b3e0dc98a87e859c98e9232f1f9a7bcb43036b52b439

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "9483295b242f51a21542e035967dbe7e:1729197972.610918"
expires: Fri, 18 Oct 2024 09:45:10 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 124198
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:12 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 id Show response
dpm.demdex.net/ 367 B
917 B 190ms
45ms XHR
application/json 18.206.129.203
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1729241110610

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.206.129.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-206-129-203.compute-1.amazonaws.com

Software

Resource Hash

6f105f6fa81f4cb957e1796190c897c9ab70d2c1fd15cc7a7aa778ee6cf95b88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v066-031fe6468.edge-va6.demdex.com 3 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: 4C+LUOs+SAU=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.fortinet.com
content-length: 311
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 35 KB
13 KB 30ms
28ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "d8232f86c8016a8e0acaa7ecfdf72b3e:1722493571.189276"
expires: Fri, 18 Oct 2024 09:45:10 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 13012
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 3 KB
2 KB 40ms
39ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "bb4b6453e3ab80111a2b227318d22efb:1722493571.614634"
expires: Fri, 18 Oct 2024 09:45:10 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1597
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 0786.js Show response
script.crazyegg.com/pages/scripts/0117/ 7 KB
3 KB 146ms
46ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eff032f2a7c04897a921492a9ce71e4fcbd047f1b2b487177955f000d6a182d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 188154
cf-polished: origSize=6996
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: text/javascript
last-modified: Wed, 16 Oct 2024 04:24:21 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d47402f59718cba-EWR
access-control-allow-origin: *
ce-version: 11.5.299
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 240ms
29ms Script
application/javascript 23.212.251.6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.251.6 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-212-251-6.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111bb"
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 11:45:11 GMT
accept-ranges: bytes
content-length: 18819
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 29 KB
9 KB 165ms
48ms Script
application/x-javascript 23.62.165.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.62.165.92 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-165-92.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9f5da34f9af883822335cae8d65129b525249727f2f6d2277af00c28b520fee2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Content-Encoding: gzip
ETag: "77592c9c8cb3fb76384b235442a3df99:1729083409.642176"
Connection: keep-alive
Expires: Fri, 18 Oct 2024 09:05:10 GMT
Accept-Ranges: bytes
X-CC: US
Content-Length: 9009
X-RG: NA
Date: Fri, 18 Oct 2024 08:45:10 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 16 Oct 2024 12:54:43 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 25f2dd15-02c6-4e7a-bc8b-c5722b49624d Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 163ms
46ms Script
application/javascript 34.86.110.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.86.110.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.110.86.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-request-id: F_9_oOZ13sQjt6NUds9B
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 225ms
41ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7BF94B6ACE444A2491B038BD34065696 Ref B: PHL30EDGE0212 Ref C: 2024-10-18T08:45:11Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H2 200 RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 9 KB
2 KB 31ms
30ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: da508d57052981b6c0da5a43dfa9d1f121bc8d7617b0bef811d64f2c75084f39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:10 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1845
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 358 B
483 B 29ms
28ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c52f6ff7a6d84e31cfbbe1df40a73422d6fb962fd36afba65e8a1ed9bcb9ff8c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:10 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 227
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 703 B
683 B 41ms
40ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8da358c85e9c21db0915f790c57a8c6650d81b8d112916934747fb25e4490fc2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:10 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 426
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 366 KB
121 KB 186ms
58ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8230a81c3dd623e329a01eb7b84dc5155e8fd670f806f3856e1c5c22eaf46dfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 08:45:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 123112
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 RC06cd6a06a307489f80febc787462cb12-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 635 B
642 B 39ms
39ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC06cd6a06a307489f80febc787462cb12-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: abf599589c18766b9bea08b97863041c55bfa1ce6d62d5839b9bd60d5895504f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:10 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 385
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 dest5.html
fortinet.demdex.net/ Frame 77DF 0
0 138ms
40ms Document
text/html 54.85.187.162
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.85.187.162 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-85-187-162.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 18 Oct 2024 08:45:10 GMT
dcs: dcs-prod-va6-2-v066-0bb323d6c.edge-va6.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 16 Oct 2024 09:34:55 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: VdlTXyLFSgI=

GET
H2

200

ibs:dpid=411&dpuuid=ZxIgFwAAAJVntwOF
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=34358979600019794372491219540831009332
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZxIgFwAAAJVntwOF

42 B
716 B

32ms
32ms

Image
image/gif

18.206.129.203
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZxIgFwAAAJVntwOF

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Server

18.206.129.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-206-129-203.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v066-00271bc98.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: FLb6HC8qQWc=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZxIgFwAAAJVntwOF
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Fri, 18 Oct 2024 08:45:11 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

POST
H2 200 delivery Show response
fortinet.tt.omtrdc.net/rest/v1/ 351 B
842 B 242ms
61ms XHR
application/json 63.140.39.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.tt.omtrdc.net/rest/v1/delivery?client=fortinet&sessionId=9b1ffeb8d4644de0bc12393b4925e7eb&version=2.10.0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.45 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-45.data.adobedc.net

Software

jag /

Resource Hash

b0686aeb71d4a0db91943c4b697121f112b892c621bd36bd2f4321ab4015c5c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 59f797c7-1ec5-4f77-8248-81fa625d5021
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://www.fortinet.com
date: Fri, 18 Oct 2024 08:45:11 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/site/ 10 KB
2 KB 121ms
38ms XHR
application/json 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fc91c743a42a59c3f9c7a1f38416a09bfd75a112056e19aa79351827fa2cb77

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 188155
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/json
last-modified: Wed, 16 Oct 2024 04:24:21 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d4740302b8542df-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1806
ce-version: 11.5.299
server: cloudflare

GET
H/1.1 200
OK 00ad3119690e692fd6990245f9741ea8f1 Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
516 B 231ms
73ms Script
text/html 23.62.165.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.62.165.92 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-62-165-92.deploy.static.akamaitechnologies.com

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
Cache-Control: max-age=60
ob-sent-time: 1729218091970
Content-Encoding: gzip
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Expires: Fri, 18 Oct 2024 08:46:11 GMT
Access-Control-Allow-Origin: *
X-CC: US
Content-Length: 22
X-RG: NA
Date: Fri, 18 Oct 2024 08:45:11 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
x-traceid: 129023246c27ca748c6d7376a1118d13

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 184ms
72ms Fetch
text/html 23.62.165.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.62.165.92 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-165-92.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Connection: keep-alive
Observe-Browsing-Topics: ?1
Expires: Fri, 18 Oct 2024 09:05:11 GMT
Access-Control-Allow-Origin: *
X-CC: US
Content-Length: 26
X-RG: NA
Date: Fri, 18 Oct 2024 08:45:11 GMT
Content-Type: text/html

GET
H/1.1 200
OK unifiedPixel Show response
tr.outbrain.com/ 53 B
321 B 232ms
72ms Fetch
image/gif 64.202.112.191
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?au=false&bust=07642667151173008&referrer=&cht=ot&marketerId=00ad3119690e692fd6990245f9741ea8f1&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&g=0&obApiVersion=1.1&obtpVersion=2.0.5

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

64.202.112.191 , United States, ASN23352 (SERVERCENTRAL, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 54
content-encoding: br
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: image/gif;
x-traceid: 9ebe30e46a17be7c1646eb458d4d04fc

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 205ms
45ms Script
application/javascript 64.202.112.191
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

64.202.112.191 , United States, ASN23352 (SERVERCENTRAL, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 39
content-encoding: br
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/javascript
x-traceid: c862f2fc302031871197bc5079a51d0e

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 317 KB
105 KB 84ms
84ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0fb1f234509ab7b7cb8bd935b4b4e489e538c1986e77bb5f1a3ce7ddd598e229

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 08:45:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 107640
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 41ms
35ms XHR
text/html 23.212.251.6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.251.6 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-212-251-6.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.fortinet.com
content-length: 7
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 22 B
313 B 174ms
79ms XHR
text/html 2600:1408:c400:d::17cd:6a47
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:d::17cd:6a47 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 85ff6d90fd5e9394262eb0cf336dd65c909254120191a048fddcade68ace23f0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2600:803:a88:3112::112
expires: Fri, 18 Oct 2024 08:45:11 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729241111157_400219721_132251650_21_789_10_33_219";dur=1
access-control-allow-origin: https://www.fortinet.com
content-length: 22
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 83ms
79ms Image
image/gif 23.212.251.6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0f9de8e0-1609-40df-8e9c-b0f81ae9c572&session=d2225a5f-afe5-4d95-8e4b-3089d24365dd&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A11%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&pageViewId=bc502bad-94cd-4b72-895e-a636cfa2b1bf&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.251.6 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-212-251-6.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 08:45:11 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 82ms
79ms Image
image/gif 23.212.251.6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0f9de8e0-1609-40df-8e9c-b0f81ae9c572&session=d2225a5f-afe5-4d95-8e4b-3089d24365dd&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2018%20Oct%202024%2008%3A45%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%225eeecf22b2d12a77a14639dce97b7a36%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2018%20Oct%202024%2008%3A45%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2018%20Oct%202024%2008%3A45%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2018%20Oct%202024%2008%3A45%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227381d1d7c753fe2d8e217c3fdc44c0f17418dcc4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2018%20Oct%202024%2008%3A45%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&pageViewId=bc502bad-94cd-4b72-895e-a636cfa2b1bf&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.251.6 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-212-251-6.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 08:45:11 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 17532650.js Show response
bat.bing.com/p/action/ 371 B
418 B 36ms
35ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17532650.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0e0c8cedb72a7e5a3080203509132486e267e5d1b0c5c6eae78ac16f7928ff01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6C418C699F4548E3809E0E10EAD41C6C Ref B: PHL30EDGE0212 Ref C: 2024-10-18T08:45:11Z
x-cache: CONFIG_NOCACHE
date: Fri, 18 Oct 2024 08:45:10 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 2780555e46c3031ae97407e9c52b4705.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 105 KB
36 KB 45ms
45ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61917dc4b13b887a30af978c934892e7db4329ba72bbd655635613b537d760e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 122291
cf-ray: 8d4740306a4f8cba-EWR
cf-polished: origSize=107371
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: text/javascript
last-modified: Tue, 08 Oct 2024 19:20:03 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 257 KB
91 KB 72ms
70ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

357c171eefe3fd37ea33c751ec6d06cde0adf0894ae54032a2663687d47f9b61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 08:45:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 18 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92678
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 63ms
62ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8139798c3e25feafa256c3f781f37bdb81a86cfd551c5f010b6ef36cedd270d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 08:45:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 18 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81697
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 238 KB
85 KB 52ms
51ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2fe9108e60e5eb58e132c65e26c89ca93158be701ae7033bafa5c6b3267b0b97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 08:45:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 18 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 87326
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 55ms
54ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4829842a4a23cf9fae872ee9906320d1a7b4f4c282e6208c74f17a1b5bc27729

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 08:45:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 18 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90328
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 191ms
59ms Fetch
text/plain 2607:f8b0:400d:c0b::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-38BQ9XFDT4&gtm=45je4ah0v9191763579za200&_p=1729241110843&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101529666~101686685~101823847&cid=1465091660.1729241111&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1729241111&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&dt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1588
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c0b::8a Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 47 KB
17 KB 253ms
74ms Script
application/javascript 2400:52e0:1a00::1207:2
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1a00::1207:2 Chicago, United States, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-IL1-1207 /
Resource Hash: 96fa0a3199b1184d9aab3b1a117e7b88974daff72641aee7f50b44f80d404aa4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "6707e1b1-bb6c"
cdn-fileserver: 749
date: Fri, 18 Oct 2024 08:45:11 GMT
cdn-storageserver: NY-268
last-modified: Thu, 10 Oct 2024 14:16:17 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 10/16/2024 19:41:47
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 46d3cd5b67163e4f9070759cee338517
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 941
server: BunnyCDN-IL1-1207
cdn-requestcountrycode: US

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 764 B
664 B 166ms
73ms XHR
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: b14dd8572d41acd561188da5417cef18c475b3621a03be38f12fe100ef84a795

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.fortinet.com
content-length: 404
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 141ms
45ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Fri, 18 Oct 2024 08:45:11 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H2 204 0
bat.bing.com/action/ 0
361 B 37ms
36ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=0435404b-1d2f-4720-bdfa-421294b3c571&bo=1&sid=492b04908d2d11efa95ec7e2fd51a765&vid=492b19f08d2d11efb4535bf432ab7675&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&kw=FortiGuard%20Labs%20Threat%20Research,zero-day%20vulnerability&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&r=&lt=572&pt=1729241109609,,,,,0,1,2,2,118,9,118,165,183,175,548,548,572,,,&pn=0,0&evt=pageLoad&sv=1&cdb=AQET&rn=635153

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 58FA86AF7E8C481392CDBBA2C7363969 Ref B: PHL30EDGE0212 Ref C: 2024-10-18T08:45:11Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 18 Oct 2024 08:45:11 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 33ms
32ms Image
image/gif 23.212.251.6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0f9de8e0-1609-40df-8e9c-b0f81ae9c572&session=d2225a5f-afe5-4d95-8e4b-3089d24365dd&event=ipv6&q=%7B%22address%22%3A%222600%3A803%3Aa88%3A3112%3A%3A112%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&pageViewId=bc502bad-94cd-4b72-895e-a636cfa2b1bf&ipv6=2600%3A803%3Aa88%3A3112%3A%3A112&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.251.6 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-212-251-6.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 08:45:11 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 activityi;fledge=1;src=10050195;npa=0;auiddc=2122270218.1729241111;ps=1;pcor=722495477;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9185241837za200zb9123037237;gcd=1...
td.doubleclick.net/td/fls/rul/ Frame 312A 0
0 176ms
54ms Document
text/html 2607:f8b0:400d:c0d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=2122270218.1729241111;ps=1;pcor=722495477;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 08:45:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;src=10050195;npa=0;auiddc=2122270218.1729241111;ps=1;pcor=722495477;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9185241837za200zb9123037237;gcd=13l3l3l3l1l...
ad.doubleclick.net/ 42 B
65 B 523ms
411ms Image
image/gif 209.85.144.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;src=10050195;npa=0;auiddc=2122270218.1729241111;ps=1;pcor=722495477;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

209.85.144.149 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

qv-in-f149.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Fri, 18 Oct 2024 08:45:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET activity;register_conversion=1;src=10050195;npa=0;auiddc=2122270218.1729241111;ps=1;pcor=722495477;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9185241837za200zb9123...
ad.doubleclick.net/ 0
0

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/sampling/ 46 B
279 B 39ms
38ms XHR
application/json 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/sampling/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29d6b32f545f36a29ab83a4be5f92d4ebfb43a6dcc6457f7681a8478e5e8ea6c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 188450
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/json
last-modified: Wed, 16 Oct 2024 04:24:21 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d474031dc2b42df-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 65
ce-version: 11.5.299
server: cloudflare

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 43 B
61 B 161ms
47ms Script
text/javascript 2607:f8b0:4004:c1f::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1729241111343&cv=11&fst=1729241111343&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 37
date: Fri, 18 Oct 2024 08:45:11 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 662878185
td.doubleclick.net/td/rul/ Frame 0B04 0
0 131ms
74ms Document
text/html 2607:f8b0:400d:c0d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/662878185?random=1729241111343&cv=11&fst=1729241111343&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 08:45:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 5 KB
2 KB 108ms
50ms Script
text/javascript 2607:f8b0:4004:c1f::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1729241111397&cv=11&fst=1729241111397&bg=ffffff&guid=ON&async=1&gtm=45be4ah0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

931ed055a12877ce15aa12c68d6d51b88aea90a2c98095f9a58441267b82a54b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2405
date: Fri, 18 Oct 2024 08:45:11 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 609297413
td.doubleclick.net/td/rul/ Frame 32DC 0
0 69ms
68ms Document
text/html 2607:f8b0:400d:c0d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/609297413?random=1729241111397&cv=11&fst=1729241111397&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ah0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 08:45:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/ 5 KB
2 KB 46ms
45ms Script
text/javascript 2607:f8b0:4004:c1f::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/?random=1729241111464&cv=11&fst=1729241111464&bg=ffffff&guid=ON&async=1&gtm=45be4ah0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ebaeb8873c24b890cac4f7f1770a98da863e6b1a23f0d1c8d747dd75e7c2a975

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2415
date: Fri, 18 Oct 2024 08:45:11 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 729495989
td.doubleclick.net/td/rul/ Frame 5F81 0
0 55ms
53ms Document
text/html 2607:f8b0:400d:c0d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/729495989?random=1729241111464&cv=11&fst=1729241111464&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ah0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 08:45:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 clock
tracking.crazyegg.com/ Frame 0
0 233ms
83ms Preflight 18.216.31.172
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1729241111523&tk=329ee1373036c5ddcda74cf257baa0a6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.216.31.172 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-216-31-172.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public, max-age=86400
date: Fri, 18 Oct 2024 08:45:11 GMT
server: awselb/2.0
vary: Access-Control-Request-Headers, Origin, Access-Control-Request-Method

POST
H2 200 clock Show response
tracking.crazyegg.com/ 40 B
146 B 123ms
122ms XHR
text/plain 18.216.31.172
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1729241111523&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.216.31.172 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-216-31-172.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 42ca4de195dbfe6c66734969bcfe85fd62e7cb05b17b7888415f8989af398c92

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store
access-control-allow-origin: *
content-length: 40
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: text/plain
server: awselb/2.0

GET
H2 200 api.min.css
a.omappapi.com/app/js/ 10 KB
3 KB 278ms
65ms Stylesheet
text/css 2400:52e0:1a00::1207:2
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1a00::1207:2 Chicago, United States, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-IL1-1207 /
Resource Hash: a4db214a51d8aa0b6a55aab329c983c0dba1976db88c499c75410392e220f9e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "6707e1c2-2644"
cdn-fileserver: 749
date: Fri, 18 Oct 2024 08:45:11 GMT
cdn-storageserver: NY-267
last-modified: Thu, 10 Oct 2024 14:16:34 GMT
content-type: text/css
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 10/16/2024 19:41:47
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 5b63172be3db8a327ebfd09a55c7cd56
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 845
server: BunnyCDN-IL1-1207
cdn-requestcountrycode: US

GET
H2 401 39852 Show response
api.omappapi.com/v2/embed/ 165 B
592 B 183ms
96ms XHR
application/json 2606:4700:3108::ac42:2af8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2af8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-user-agent: standard--
cf-cache-status: DYNAMIC
expires: Fri, 18 Oct 2024 08:46:34 GMT
x-cache: Error from cloudfront
x-amz-cf-id: 6Tsz9PVHLEvlJpf2UepSa2mLWNX9htFnHLbpeh2L09Jt42jjHuuWcw==
date: Fri, 18 Oct 2024 08:45:11 GMT
x-cache-config: 0 0
content-type: application/json
vary: Accept-Encoding, User-Agent
access-control-allow-headers: X-CSRF-Token
cache-control: public, max-age=120, stale-while-revalidate=1800
via: 1.1 ccbf01f3e1fbbe27e81779a9bd6e91de.cloudfront.net (CloudFront)
cf-ray: 8d474033ce4632b2-PHL
access-control-allow-origin: *
content-length: 165
x-amz-cf-pop: PHL51-P1
server: cloudflare

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 163ms
64ms Script
text/javascript 2606:4700::6812:1347
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1347 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 41481
via: 1.1 google
cf-ray: 8d474033e88642fd-EWR
expires: Fri, 18 Oct 2024 09:05:11 GMT
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK tag.js Show response
abm-tracking.demandscience.com/ 2 KB
2 KB 411ms
155ms Script
application/javascript 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/tag.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: public, max-age=0
ETag: W/"82b-18f5d3a3d78"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2091
Date: Fri, 18 Oct 2024 08:45:11 GMT
Content-Type: application/javascript; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Thu, 09 May 2024 12:00:49 GMT

GET
H2 200 wid.tracker.js Show response
tmp.argusplatform.com/js/ 8 KB
3 KB 241ms
90ms Script
text/javascript 2620:1ec:bdf::41
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://tmp.argusplatform.com/js/wid.tracker.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::41 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preloadmax-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preloadmax-age=31536000
cache-control: public, must-revalidate, max-age=30
x-dns-prefetch-control: off
content-encoding: br
etag: "28476869"
referrer-policy: same-origin
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
date: Fri, 18 Oct 2024 08:45:11 GMT
x-xss-protection: 1; mode=block
content-type: text/javascript
last-modified: Sat, 08 Jun 2024 11:51:22 GMT
vary: Accept-Encoding
x-azure-ref: 20241018T084511Z-168d47657fdvfckr8wwtb3p5bc00000009gg00000000364k

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ 161 B
711 B 296ms
72ms Script
text/javascript 216.200.232.249
PAEDAE-INC

General

Check archive.org

Show headers Download Go to

Full URL

https://pixel.mathtag.com/event/js?mt_id=1629896&mt_adid=260855&mt_exem=&mt_excl=&v2=&v3=&s1=&s2=&s3=&v1=en:blog:threat-research:burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa:new_tab

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.200.232.249 Frederick, United States, ASN30419 (PAEDAE-INC, US),

Reverse DNS

Software

MT3 1668 f41eadd master ord ord-pixel-x6 config_version:"1033" /

Resource Hash

98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457

Security Headers

Name	Value
Strict-Transport-Security	31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Strict-Transport-Security: 31536000
Cache-Control: no-cache
Content-Encoding: gzip
Connection: close
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Fri, 18 Oct 2024 08:45:11 GMT
X-XSS-Protection: 0
Content-Type: text/javascript
Server: MT3 1668 f41eadd master ord ord-pixel-x6 config_version:"1033"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 324 KB
107 KB 51ms
50ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

13b70c5c4878d80d7366077cafdf5a4c2f4deab7d8b49916e955411c997c7557

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 08:45:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 109681
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
64 B 181ms
60ms Image
image/gif 2607:f8b0:400d:c0b::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1729241111397&cv=11&fst=1729238400000&bg=ffffff&guid=ON&async=1&gtm=45be4ah0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnffXSpszrB3dMqBGdDrqI0LxGnQjdVsQ&random=760156596&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Oct 2024 08:45:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/729495989/ 42 B
64 B 180ms
60ms Image
image/gif 2607:f8b0:400d:c0b::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/729495989/?random=1729241111464&cv=11&fst=1729238400000&bg=ffffff&guid=ON&async=1&gtm=45be4ah0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=2122270218.1729241111&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfaaPjK5rr-C3PIUpXGhnvE3t3Cikdig&random=577092770&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Oct 2024 08:45:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 s41688172857238
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/ 43 B
372 B 204ms
46ms Image
image/gif 63.140.39.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/s41688172857238?AQB=1&ndh=1&pf=1&t=17%2F9%2F2024%2022%3A45%3A11%204%20600&sdid=43600FCA4557AEDF-28B472B87026372B&mid=33982131931045165172455786578050309052&aamlh=7&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Aburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%3Anew_tab&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Aburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%3Anew_tab&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&v106=San%20Jose&v107=California&v108=United%20States&v126=NA&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.65 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-65.data.adobedc.net

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
pragma: no-cache
etag: 3713517009745412096-4618265113298817895
x-content-type-options: nosniff
expires: Thu, 17 Oct 2024 08:45:11 GMT
access-control-allow-origin: *
p3p: CP="This is not a P3P policy"
content-length: 43
date: Fri, 18 Oct 2024 08:45:11 GMT
x-xss-protection: 1; mode=block
last-modified: Sat, 19 Oct 2024 08:45:11 GMT
vary: *
server: jag
content-type: image/gif;charset=utf-8

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 41ms
40ms Fetch
text/plain 2607:f8b0:400d:c0b::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-JH142QCQCJ&gtm=45je4ah0v893708426za200zb9123037237&_p=1729241110843&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101686685~101823848&cid=1465091660.1729241111&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1729241111&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&dt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2114
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c0b::8a Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
448 B 68ms
67ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1729241111731&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
ibc_rate_tier: 1247773
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Fri, 18 Oct 2024 09:45:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AHmUCY2-RuZWtZKZwr07ugRvIPPOidYC5xJjpv9nPXGM2mOQl0-mk_j5mdlxyWzjrEP9_KVVGwf_NFSgog
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 235ms
93ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1729241111731&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 18 Oct 2024 08:45:11 GMT
expires: Fri, 18 Oct 2024 08:45:11 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AHmUCY0O51RelX6URA-b0K8L4yNk5GfsNAwYXDseXBtkd_qkv6W8eLDMy1whADcZ4yK09x-O4QbDEmkIKg

GET /
pixels.argusplatform.com/wh/track/ 0
0

GET
H2 200 fp.min.js Show response
cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/ 33 KB
14 KB 177ms
37ms Script
application/javascript 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY"
age: 24718
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220049-FRA, cache-ewr-kewr1740020-EWR
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13749
x-jsd-version: 3.4.2

GET
H2 200 site-visitors Show response
intentstream.contanuity.com/api/ 115 B
374 B 138ms
132ms Fetch
application/json 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-pixel-auth: true
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=15724800; includeSubdomains
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 115
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/json; charset=utf-8
vary: origin
server: nginx

OPTIONS
H2 200 site-visitors
intentstream.contanuity.com/api/ Frame 0
0 435ms
204ms Preflight 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-pixel-auth
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-pixel-auth
access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
content-length: 0
date: Fri, 18 Oct 2024 08:45:12 GMT
server: nginx
strict-transport-security: max-age=15724800; includeSubdomains

GET
BLOB 200
OK 296c262b-86bd-42b8-83b1-a6a73ce099d9
https://www.fortinet.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.fortinet.com/296c262b-86bd-42b8-83b1-a6a73ce099d9
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 32ms
32ms Image
image/gif 23.212.251.6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0f9de8e0-1609-40df-8e9c-b0f81ae9c572&session=d2225a5f-afe5-4d95-8e4b-3089d24365dd&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A11%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%221005%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&pageViewId=bc502bad-94cd-4b72-895e-a636cfa2b1bf&ipv6=2600%3A803%3Aa88%3A3112%3A%3A112&v=1.1.29

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.251.6 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-212-251-6.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 08:45:12 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 2 KB
1014 B 32ms
31ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 59ea071c19f22e30a783ae7ed96c2009fe39746b3fb77136746bf1d3a358a1ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 757
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7be3d22b2fd6487ca9390477738587fe-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 819 B
757 B 39ms
39ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC7be3d22b2fd6487ca9390477738587fe-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2493fbbf9465c0041d1943806f94fd639157b03ead282fae2e22ae303944a15b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 501
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC407b573180554ea6b11eecdc31ecbd3f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 819 B
756 B 41ms
40ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC407b573180554ea6b11eecdc31ecbd3f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ec464f6c5f7005d9ada96632adba09faea580a846b4e7ad18dbaa7bd7a64467a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 499
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC8c594cd344f84ab89afc779d8f53fff4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 1 KB
811 B 41ms
40ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC8c594cd344f84ab89afc779d8f53fff4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f2bee6f6d773e5a597a2b07e414b9abbaec0715598ecbfcea71540b5e463243b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 554
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5915f5d7e33546579cd5fd510349ed90-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 722 B
715 B 41ms
41ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC5915f5d7e33546579cd5fd510349ed90-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a42d5f034c99d5cef32cb878b42708bf7543cd8712dbe6174b8fd05cd362ba2d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 458
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC1d92f04752ae42a38e54de48cb85adf4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 661 B
648 B 41ms
40ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC1d92f04752ae42a38e54de48cb85adf4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 6b2e250a402fc951cf47caa46780f7180ef6821dcbc24e80baf52fbc33703a30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 391
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf940460311f349b5af69d075bdef61d4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 368 B
491 B 41ms
40ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RCf940460311f349b5af69d075bdef61d4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ba3439f9f07d32121ea36671828c9980e2af00de8f96443e343ab78069a7511c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 234
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 754 B
704 B 40ms
40ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 3fb6370c2aae6f63941faadef34260a95920ae6894d92e3cf1491b8963f9dd1c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 447
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 2 KB
968 B 44ms
44ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 741d8cc14f5aef46e2d47e5c8b0ea850563ba2b04fabb88b1a6201f6bb1ea43b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 712
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 1021 B
856 B 39ms
39ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b89df263d3d532643cf924dd6833646f818fc82fca1cd3c1f5ebe0c53d68bc99

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 599
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcd84e40d19c24776bef77836ab2f8df6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 819 B
757 B 40ms
39ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b44b35c5eff8e5fdc0224ebecd76436608988dad0886ab4d5508a51de041af4d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 501
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 388 B
498 B 40ms
39ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 83fa138e4693e547cec48874c1258ffc1152b46a3f6df25a2e7099fec4a8af0d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 242
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5c60a51709a94068afbf065e1448b617-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 664 B
656 B 45ms
45ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC5c60a51709a94068afbf065e1448b617-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1ba342118d432fefd8e7dccfa482a162ee6b24b9be731aac2a4762eedd9ad823

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 400
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 2 KB
980 B 39ms
38ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e78bdb37a782cc88645fa74724d2f8acbb354c77f113863d3bb2abc713f01e48

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 723
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/ 966 B
807 B 39ms
39ms Script
application/x-javascript 2600:1408:c400:195::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/75a32947e0ce/RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:195::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 22f9534fba4207e26d53d6181e49e4f00f34473ffaad6e5245af3daee739f780

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "c2de8f7648469150dff108afe80f149f:1729197974.218526"
expires: Fri, 18 Oct 2024 09:45:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 550
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript
last-modified: Thu, 17 Oct 2024 20:46:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 p Show response
i.simpli.fi/ 798 B
762 B 77ms
32ms Script
application/javascript 34.86.110.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp
Requested by: Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.86.110.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.110.86.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: 146a4fab9c3295f3592d80aab8b3041223a682747c3491495ef7cf4132b7f321

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: openresty

GET
H/1.1 200
OK favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/ 318 B
2 KB 44ms
43ms Other
image/vnd.microsoft.icon 2600:1f18:1492:1701:a964:c08d:f5eb:b0c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1701:a964:c08d:f5eb:b0c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "13e-565c628eb6a00-gzip"
Age: 1250397
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: fI-bzBwqtdHN9hFqwLpDwTD-4B2sbAAIHFq6tW2KCV9XiekrgXSLzw==
Date: Thu, 17 Oct 2024 21:08:21 GMT
Content-Type: image/vnd.microsoft.icon
Last-Modified: Thu, 22 Feb 2018 05:17:28 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 20df28836b486eb31c7f2537fe67b622.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 133
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK spx Show response
dx.mountain.com/ 23 KB
6 KB 168ms
32ms Script
application/javascript 52.7.151.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cb=98200101172237360term=value
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.7.151.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-7-151-245.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: 812483f0612cd7a2cabd76d954b56ec4e145e55c1ee89bfbf704801e368cd17a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 2
expires: Thu, 01 Jan 1970 00:00:00 GMT
be: spx-prod
date: Fri, 18 Oct 2024 08:45:11 GMT
content-type: application/javascript;charset=utf-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: istio-envoy

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 212ms
62ms Script
application/javascript 146.75.76.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.76.157 Chicago, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Fri, 18 Oct 2024 08:45:12 GMT
x-tw-cdn: FT
last-modified: Tue, 26 Mar 2024 20:58:07 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kcgs7200117-IAD, cache-chi-kigq8000140-CHI
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 180ms
34ms Script
application/javascript 2600:1408:c400:5::17c7:3719
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:5::17c7:3719 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=16764
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Fri, 18 Oct 2024 08:45:12 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 22 KB
7 KB 185ms
51ms Script
text/javascript 52.22.110.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.110.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-110-67.compute-1.amazonaws.com
Software: /
Resource Hash: 384e04539a0724c84b3bee0e3d53fd76cc5069946de265e9153b9ad587c8d824

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: max-age=5
content-encoding: gzip
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/javascript

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1773420&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

43 B
1 KB

58ms
56ms

Image
image/gif

68.67.161.182
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Protocol

Server

68.67.161.182 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 208.252.80.112; 208.252.80.112; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: d11f305f-f7d6-475f-982f-ad500c60a47c
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Oct 2024 08:45:12 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 208.252.80.112; 208.252.80.112; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 2f57e1ba-5e3f-490e-99e2-ba24241aeed2
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Oct 2024 08:45:12 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?add=36113683
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

43 B
1 KB

51ms
51ms

Image
image/gif

68.67.161.208
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Protocol

Server

68.67.161.208 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 208.252.80.112; 208.252.80.112; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 350155fd-02a1-4625-b3da-8e098aed0ea0
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Oct 2024 08:45:12 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 208.252.80.112; 208.252.80.112; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 13788dc3-5f43-4109-9dae-661c6354c76d
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Oct 2024 08:45:12 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 iztag.js Show response
tags.inzynk.io/0ulh3gex/ 34 B
443 B 184ms
42ms Script
application/octet-stream 2600:9000:2141:6400:12:dfa9:e200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.inzynk.io/0ulh3gex/iztag.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2141:6400:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding
x-amz-version-id: 15XT7F8rursoJ6jHrhKIXrYdXTZkWasY
etag: "595f7fa79bc22a7029d2751228622eb4"
age: 74317
via: 1.1 e00a954a79782fdd3cf71c54f8d15496.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 34
x-amz-cf-id: ywA064oBQnjfyfwwxUB3eSwJY7jDTcASexw9Ej3FM554Zc5CHGmv_Q==
date: Thu, 17 Oct 2024 19:34:48 GMT
content-type: application/octet-stream
last-modified: Thu, 05 Sep 2024 13:11:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P10
x-amz-server-side-encryption: AES256

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=6BB12C5AB7134149BD3FA0941DCF4618
https://sync.outbrain.com/cookie-sync?p=smaato&initiation=partner&uid=f1c15edd4b&gdpr=0&gdpr_consent=

0
360 B

183ms
55ms

Image
text/plain

64.202.112.191
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.outbrain.com/cookie-sync?p=smaato&initiation=partner&uid=f1c15edd4b&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

64.202.112.191 , United States, ASN23352 (SERVERCENTRAL, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 0
date: Fri, 18 Oct 2024 08:45:12 GMT
x-traceid: eea88cec6c96fac34cae9e66cb18c592

Redirect headers

cache-control: no-cache, must-revalidate
location: https://sync.outbrain.com/cookie-sync?p=smaato&initiation=partner&uid=f1c15edd4b&gdpr=0&gdpr_consent=
via: 1.1 d3cd567650e598ded7d5dd9266aa396c.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: r3aijx3Sdc3qd_XZbJDy63J7rj8c20R6-YTasn7sOTRDC8zccAM-fA==
date: Fri, 18 Oct 2024 08:45:12 GMT
x-amz-cf-pop: IAD89-P2
server: CloudFront

GET
H2

204

6BB12C5AB7134149BD3FA0941DCF4618
sync.1rx.io/usersync/simplifi/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/6BB12C5AB7134149BD3FA0941DCF4618

0
99 B

187ms
72ms

Image
text/plain

69.194.240.13
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.1rx.io/usersync/simplifi/6BB12C5AB7134149BD3FA0941DCF4618
Protocol: H2
Server: 69.194.240.13 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
date: Fri, 18 Oct 2024 08:44:59 GMT
pragma: no-cache

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.1rx.io/usersync/simplifi/6BB12C5AB7134149BD3FA0941DCF4618
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 17 Oct 2024 08:45:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=6BB12C5AB7134149BD3FA0941DCF4618&dongle=yf3
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=6BB12C5AB7134149BD3FA0941DCF4618&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

37 B
472 B

68ms
65ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=6BB12C5AB7134149BD3FA0941DCF4618&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: /xuid?ld=1&mid=7969&xuid=6BB12C5AB7134149BD3FA0941DCF4618&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Oct 2024 08:45:12 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=6BB12C5AB7134149BD3FA0941DCF4618

43 B
175 B

179ms
67ms

Image
image/gif

2600:1f18:612b:4200:5e2b:8808:4329:7b7f
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=6BB12C5AB7134149BD3FA0941DCF4618
Protocol: H2
Server: 2600:1f18:612b:4200:5e2b:8808:4329:7b7f Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://simplifi.partners.tremorhub.com/sync?UISF=6BB12C5AB7134149BD3FA0941DCF4618
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 17 Oct 2024 08:45:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=6BB12C5AB7134149BD3FA0941DCF4618
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=6BB12C5AB7134149BD3FA0941DCF4618

95 B
427 B

56ms
46ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=6BB12C5AB7134149BD3FA0941DCF4618

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=6BB12C5AB7134149BD3FA0941DCF4618
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Fri, 18 Oct 2024 08:45:12 GMT
server: Jetty(11.0.13)

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=6BB12C5AB7134149BD3FA0941DCF4618
https://d.agkn.com/pixel/10751/?che=1729241112742&ip=208.252.80.112&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D214280605039006788556
https://um.simpli.fi/aa_px?sk=214280605039006788556
https://um.simpli.fi/empty.gif

43 B
361 B

31ms
31ms

Image
image/gif

35.194.66.159
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

35.194.66.159 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

159.66.194.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 43
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
location: /empty.gif
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=6BB12C5AB7134149BD3FA0941DCF4618
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=6BB12C5AB7134149BD3FA0941DCF4618&ckls=true&ci=aULjUBa2IT&nc=false&trid=2047662310

43 B
1 KB

88ms
75ms

Image
image/gif

2600:9000:2073:7a00:1b:6b7d:2300:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=6BB12C5AB7134149BD3FA0941DCF4618&ckls=true&ci=aULjUBa2IT&nc=false&trid=2047662310
Protocol: H2
Server: 2600:9000:2073:7a00:1b:6b7d:2300:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length: 43
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif
x-amz-cf-pop: IAD50-C2
x-amz-cf-id: lLLE9kclJZi-MoZomABN490O-ig0AjPiwdxNqFRBcSV5-S6mTH0GvA==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=6BB12C5AB7134149BD3FA0941DCF4618&ckls=true&ci=aULjUBa2IT&nc=false&trid=2047662310
pragma: no-cache
via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif
x-amz-cf-pop: IAD50-C2
x-amz-cf-id: Ixate1KfCwOfrmoI0n5juq8yn36ZjLfUm--1AS11WhWFWwk-652EEw==

GET
H2

200

Pug
image2.pubmatic.com/AdServer/
Redirect Chain

https://um.simpli.fi/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:6BB12C5AB7134149BD3FA0941DCF4618

42 B
551 B

187ms
74ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:6BB12C5AB7134149BD3FA0941DCF4618
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:6BB12C5AB7134149BD3FA0941DCF4618
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 17 Oct 2024 08:45:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200

user-registering
ads.stickyadstv.com/
Redirect Chain

https://um.simpli.fi/freewheel
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=6BB12C5AB7134149BD3FA0941DCF4618

43 B
659 B

239ms
34ms

Image
image/gif

63.251.28.211
FREEWHEEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=6BB12C5AB7134149BD3FA0941DCF4618
Protocol: HTTP/1.1
Server: 63.251.28.211 Secaucus, United States, ASN26558 (FREEWHEEL, US),
Reverse DNS
Software: openresty /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
x-sticky-vk: 1729241112793047-1139
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Date: Fri, 18 Oct 2024 08:45:12 GMT
Content-Type: image/gif
Server: openresty

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=6BB12C5AB7134149BD3FA0941DCF4618
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 17 Oct 2024 08:45:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

engine
pbid.pro-market.net/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=6BB12C5AB7134149BD3FA0941DCF4618;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=6BB12C5AB7134149BD3FA0941DCF4618;mimetype=img;sr
https://cms.analytics.yahoo.com/cms?partner_id=DATCS
https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS
https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-zdfmSYNE2pQwJggtR1GwOBUDLa7UNgQQihg-~A

43 B
403 B

65ms
58ms

Image
image/gif

2600:1901:0:8eee::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-zdfmSYNE2pQwJggtR1GwOBUDLa7UNgQQihg-~A
Protocol: H2
Server: 2600:1901:0:8eee:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
anserver: gapp2
expires: Mon, 1 Jan 1990 0:0:0 GMT
access-control-allow-origin: *
alt-svc: clear
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length: 43
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: image/gif
server: Apache-Coyote/1.1

Redirect headers

strict-transport-security: max-age=31536000
location: https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-zdfmSYNE2pQwJggtR1GwOBUDLa7UNgQQihg-~A
age: 0
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
x-ycpi: 1
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
content-length: 0
date: Fri, 18 Oct 2024 08:45:13 GMT
x-xss-protection: 1; mode=block
server: ATS

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=6BB12C5AB7134149BD3FA0941DCF4618&j=0
https://loadm.exelator.com/load/?p=204&g=2191&simid=6BB12C5AB7134149BD3FA0941DCF4618&j=0&xl8blockcheck=1

0
771 B

77ms
64ms

Image
text/plain

34.229.3.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=6BB12C5AB7134149BD3FA0941DCF4618&j=0&xl8blockcheck=1
Protocol: H2
Server: 34.229.3.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-229-3-43.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 18 Oct 2024 08:45:12 GMT
x-powered-by: Undertow/1
server: nginx
access-control-allow-credentials: true

Redirect headers

cache-control: no-cache
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=6BB12C5AB7134149BD3FA0941DCF4618&j=0&xl8blockcheck=1
access-control-allow-credentials: true
content-length: 0
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif
x-powered-by: Undertow/1
server: nginx

GET

sync
ups.analytics.yahoo.com/ups/55964/
Redirect Chain

https://um.simpli.fi/yahoo
https://ups.analytics.yahoo.com/ups/55964/sync?uid=6BB12C5AB7134149BD3FA0941DCF4618
https://ups.analytics.yahoo.com/ups/55964/sync?uid=6BB12C5AB7134149BD3FA0941DCF4618&verify=true

0
0

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=6BB12C5AB7134149BD3FA0941DCF4618

0
421 B

217ms
33ms

Image
text/plain

34.193.229.172
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=6BB12C5AB7134149BD3FA0941DCF4618
Protocol: HTTP/1.1
Server: 34.193.229.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-229-172.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Date: Fri, 18 Oct 2024 08:45:12 GMT
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.bfmio.com/sync?pid=141&uid=6BB12C5AB7134149BD3FA0941DCF4618
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 17 Oct 2024 08:45:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

500
Internal Server Error

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=6BB12C5AB7134149BD3FA0941DCF4618

27 B
27 B

217ms
85ms

Image
text/html

23.220.132.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=6BB12C5AB7134149BD3FA0941DCF4618
Protocol: HTTP/1.1
Server: 23.220.132.230 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-132-230.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5607bc0b49036b5f13acf3f5767e0fb2fb947f5369bda253939e78e2b11f85b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Fri, 18 Oct 2024 08:45:12 GMT
Content-Length: 27
Date: Fri, 18 Oct 2024 08:45:12 GMT
AK-GRN: 0.9768dc17.1729241112.33dbe09
Content-Type: text/html

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://stags.bluekai.com/site/29931?id=6BB12C5AB7134149BD3FA0941DCF4618
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 17 Oct 2024 08:45:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

tpid=6BB12C5AB7134149BD3FA0941DCF4618
bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=6BB12C5AB7134149BD3FA0941DCF4618
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=6BB12C5AB7134149BD3FA0941DCF4618

49 B
265 B

66ms
54ms

Image
image/gif

54.159.21.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=6BB12C5AB7134149BD3FA0941DCF4618
Protocol: H2
Server: 54.159.21.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-159-21-67.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif
x-server: 10.40.48.246
server: Jetty(9.4.38.v20210224)

Redirect headers

cache-control: no-cache
location: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=6BB12C5AB7134149BD3FA0941DCF4618
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 18 Oct 2024 08:45:12 GMT
x-server: 10.40.7.20
server: Jetty(9.4.38.v20210224)

GET
H2

200

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=6BB12C5AB7134149BD3FA0941DCF4618
https://ce.lijit.com/merge?pid=2&3pid=6BB12C5AB7134149BD3FA0941DCF4618&dnr=1

43 B
511 B

89ms
75ms

Image
image/gif

34.206.151.111
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=6BB12C5AB7134149BD3FA0941DCF4618&dnr=1
Protocol: H2
Server: 34.206.151.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-151-111.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://ce.lijit.com/merge?pid=2&3pid=6BB12C5AB7134149BD3FA0941DCF4618&dnr=1
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Oct 2024 08:45:12 GMT
vary: Accept-Encoding

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=6BB12C5AB7134149BD3FA0941DCF4618
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogNkJCMTJDNUFCNzEzNDE0OUJEM0ZBMDk0MURDRjQ2MTgQABoNCJjAyLgGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=05a167ef6299c10fa7a518c200f32b9909d4cc4f970568cfdd44ce6e54587f77791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=05a167ef6299c10fa7a518c200f32b9909d4cc4f970568cfdd44ce6e54587f77791426b5417dce21&rand=07530530

0
145 B

55ms
55ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=05a167ef6299c10fa7a518c200f32b9909d4cc4f970568cfdd44ce6e54587f77791426b5417dce21&rand=07530530
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 8731A7F2D8A640B6ABD8AC1BE84B1C87 Ref B: PHL30EDGE0114 Ref C: 2024-10-18T08:45:13Z
x-li-fabric: prod-lva1
x-li-uuid: AAYkvFJGJCyTVgEYSknHFg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Oct 2024 08:45:12 GMT

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=05a167ef6299c10fa7a518c200f32b9909d4cc4f970568cfdd44ce6e54587f77791426b5417dce21&rand=07530530
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Fri, 18 Oct 2024 08:45:12 GMT

GET
H3

200

/
www.google.com/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1729241112286&cv=7&fst=1729241112286&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1770566127&cv=7&fst=1729241112286&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLH...
https://www.google.com/pagead/1p-conversion/1026675585/?random=1770566127&cv=7&fst=1729241112286&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHD...

42 B
64 B

61ms
58ms

Image
image/gif

2607:f8b0:400d:c0b::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/1026675585/?random=1770566127&cv=7&fst=1729241112286&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybEC&pscrd=IhMIuOKBksWXiQMVOQpoCB2_-ivuMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfLAZZH8rSL1bFL5LFLZP4UC7gFTDiYtnf1GSe-d-luKdFlw5f&random=2274644096

Protocol

Server

2607:f8b0:400d:c0b::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Oct 2024 08:45:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://www.google.com/pagead/1p-conversion/1026675585/?random=1770566127&cv=7&fst=1729241112286&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybEC&pscrd=IhMIuOKBksWXiQMVOQpoCB2_-ivuMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfLAZZH8rSL1bFL5LFLZP4UC7gFTDiYtnf1GSe-d-luKdFlw5f&random=2274644096
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Fri, 18 Oct 2024 08:45:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 50ms
48ms Image
text/plain 35.194.66.159
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.194.66.159 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

159.66.194.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin: *
date: Fri, 18 Oct 2024 08:45:12 GMT
x-content-type-options: nosniff

GET
H2

200

setuid
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=6BB12C5AB7134149BD3FA0941DCF4618

43 B
1 KB

85ms
80ms

Image
image/gif

68.67.161.208
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=66&code=6BB12C5AB7134149BD3FA0941DCF4618

Protocol

Server

68.67.161.208 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 208.252.80.112; 208.252.80.112; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: e2a01f04-dfc7-44c5-a904-61e1d5ef5841
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Oct 2024 08:45:12 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ib.adnxs.com/setuid?entity=66&code=6BB12C5AB7134149BD3FA0941DCF4618
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 17 Oct 2024 08:45:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=6BB12C5AB7134149BD3FA0941DCF4618&expires=365

42 B
1 KB

221ms
39ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=6BB12C5AB7134149BD3FA0941DCF4618&expires=365
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 772cc9037cd6dc6f19451a098a1a8570
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=6BB12C5AB7134149BD3FA0941DCF4618&expires=365
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 17 Oct 2024 08:45:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=6BB12C5AB7134149BD3FA0941DCF4618
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=6BB12C5AB7134149BD3FA0941DCF4618

43 B
171 B

47ms
33ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=6BB12C5AB7134149BD3FA0941DCF4618
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif
vary: Accept
server: OXGW/0.0.0

Redirect headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=6BB12C5AB7134149BD3FA0941DCF4618
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 0
date: Fri, 18 Oct 2024 08:45:12 GMT
server: OXGW/0.0.0

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_gid=CAESEJiRPsk-oTHw5hhSjUO3fqs&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6BB12C5AB7134149BD3FA0941DCF4618
https://um.simpli.fi/g_match?id=

0
320 B

31ms
31ms

Image
text/plain

35.194.66.159
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=

Protocol

Server

35.194.66.159 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

159.66.194.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
expires: Thu, 17 Oct 2024 08:45:12 GMT
access-control-allow-origin: *
date: Fri, 18 Oct 2024 08:45:12 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

cache-control: no-cache, must-revalidate
location: https://um.simpli.fi/g_match?id=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 229
date: Fri, 18 Oct 2024 08:45:12 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab Show response
abm-tracking.demandscience.com/page-tracking/fortinet_2712/ 2 B
665 B 88ms
87ms Script
application/json 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/page-tracking/fortinet_2712/https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab?visitorId=d6537317bffb3b903736e7239c156559_1729241112418&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 18 Oct 2024 08:45:12 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 190 KB
68 KB 51ms
49ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4NSPPXN

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f25f463d33decdb1f5541a41981dce02bc5998ba873bc466b79679f8e2ec9e42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 18 Oct 2024 08:45:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 18 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 69655
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK is Show response
44.212.189.233/ 32 B
437 B 148ms
32ms Fetch
text/plain 44.212.189.233
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://44.212.189.233/is?cb=1729241112546
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cb=98200101172237360term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 44.212.189.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-189-233.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e568b5aabfa0debd7a5192f2248933aaf4642f240addd580871b0f198b59f564

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 0
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
content-length: 32
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/plain;charset=utf-8
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
977 B 248ms
136ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
x-li-fabric: prod-lor1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
access-control-allow-methods: GET, OPTIONS
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/json
access-control-allow-headers: *
x-li-pop: afd-prod-lor1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-fs-uuid: 000624bc5241abd47ab4479f7d2c4e29
x-msedge-ref: Ref A: 12A725D140894292AA3D686D564A1358 Ref B: PHL30EDGE0212 Ref C: 2024-10-18T08:45:12Z
x-restli-protocol-version: 1.0.0
x-li-uuid: AAYkvFJBq9R6tEeffSxOKQ==
access-control-allow-origin: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&li_adsId=2b304801-fe70-4b41-83fe-8d03338a6e3b&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&li_adsId=2b304801-fe70-4b41-83fe-8d03338a6e3b&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%252C6313418%26time%3D1729241112576%26li_adsId%3D2b30...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&li_adsId=2b304801-fe70-4b41-83fe-8d03338a6e3b&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&li_adsId=2b304801-fe70-4b41-83fe-8d03338a6e3b&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Ft...

0
488 B

161ms
56ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&li_adsId=2b304801-fe70-4b41-83fe-8d03338a6e3b&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cookiesTest=true&liSync=true&e_ipv6=AQILJL6cRuDLqgAAAZKezWHvuJNqnjloysc4GVbaXZdf8g_IMtXkN7NY53KoyrmB7lJJINWUcIY
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 83E8B1CA460F493E841CA4BB070498B1 Ref B: PHL30EDGE0221 Ref C: 2024-10-18T08:45:13Z
x-li-fabric: prod-lva1
x-li-uuid: AAYkvFJJB8CDYbVvTrlDmg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729241112576&li_adsId=2b304801-fe70-4b41-83fe-8d03338a6e3b&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cookiesTest=true&liSync=true&e_ipv6=AQILJL6cRuDLqgAAAZKezWHvuJNqnjloysc4GVbaXZdf8g_IMtXkN7NY53KoyrmB7lJJINWUcIY
x-msedge-ref: Ref A: 6D42DFB3BBF94E89AE4086A994B15B44 Ref B: PHL30EDGE0114 Ref C: 2024-10-18T08:45:13Z
x-li-fabric: prod-lva1
x-li-uuid: AAYkvFJGdEPNizFFm2LUfQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Oct 2024 08:45:12 GMT

GET
H2

200

burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
10104846.fls.doubleclick.net/activityi;dc_pre=CKLNhZLFl4kDFX-jgwgdSLcAQw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/ Frame DC9D
Redirect Chain

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-iva...
https://10104846.fls.doubleclick.net/activityi;dc_pre=CKLNhZLFl4kDFX-jgwgdSLcAQw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-...

0
0

64ms
51ms

Document
text/html

142.250.31.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10104846.fls.doubleclick.net/activityi;dc_pre=CKLNhZLFl4kDFX-jgwgdSLcAQw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f148.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 2026
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 08:45:12 GMT
expires: Fri, 18 Oct 2024 08:45:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 08:45:12 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10104846.fls.doubleclick.net/activityi;dc_pre=CKLNhZLFl4kDFX-jgwgdSLcAQw;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 227 KB
58 KB 168ms
41ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f4cfd4a5b95dfb31c47cd567d9719fc12a0453f6ff27e2872147a9740e4b9e56

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=30, rtx=0, c=23, mss=1232, tbw=5699, tp=10, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: hnUgy/iI6x2RQLALgXsCAfHt8BfxWx239UcJ6XKcCAlmTfb46rfWfg9Fs0ZJSWrPr28fUrrjQxFVHq9HpgmkZA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 59352
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 siteanalyze_6033413.js Show response
siteimproveanalytics.com/js/ 38 KB
12 KB 124ms
39ms Script
application/javascript 2606:4700:3035::6815:3296
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6033413.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:3296 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "8451e15415563cef4e816d6dd250d58a"
age: 5865
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9XWa5pq25VkvqOO%2Bfce2oKK4Zno2ckSHUmPNPfZ64uiYpFDiOJMpyxMtz9jyPR5QGpYHW7YYrBxuR1csAUx8o2XBhVOqcVd3Mlzk6DL0AyAWpx%2FNIt0ZT8h3E8adoU7zAFPylscCA%2BuKpxk2yrbJgAcDDNVVqoM%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 03 Sep 2024 18:55:37 GMT
vary: Accept-Encoding
x-amz-id-2: l47bVAifPbjJdBDLVK42zjCqQ7M8RcRqbdrlC4N2RrHVLO0BHhARxbXkr7Bf7QBpgdzhYHxo//C24NsDTElAjWXxHZLNB1JPqorWwlaG0DU=
cache-control: max-age=86400, no-transform
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: MRC5SE735YS1SKQ2
cf-ray: 8d47403a8eb015c7-EWR
accept-ranges: bytes
content-length: 11550
server: cloudflare

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 51ms
44ms Stylesheet
text/css 52.22.110.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.110.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-110-67.compute-1.amazonaws.com
Software: /
Resource Hash: 9b3beecd9e07624801f6302991b67619c53b88bacbd63e07dd1d2286842bd625

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 134ms
32ms Fetch
image/jpeg 52.22.110.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.110.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-110-67.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/jpeg

GET
H2 200 adsct
t.co/i/ 43 B
468 B 304ms
129ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=31740018-acd4-491f-b3b9-0ed8bb2b8663&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7c66e6ae-8098-4976-a325-18fb9c4af6e1&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 06d6ff3d1580a158
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 9e3fc66a2bdaa0aa7fbc0004a8f773fd3cf8d56bdb98fa354a141c7558822aeb
cf-cache-status: DYNAMIC
cf-ray: 8d47403b3f3f726b-EWR
x-response-time: 6
content-length: 43
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
211 B 339ms
127ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=31740018-acd4-491f-b3b9-0ed8bb2b8663&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7c66e6ae-8098-4976-a325-18fb9c4af6e1&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 81c24e22f58593f2
cache-control: no-cache, no-store, max-age=0
x-connection-hash: f4c2a09b6ffab59dcac11b73a753c880a0270318befd664eb809b985ba3a11ea
x-response-time: 79
content-length: 43
date: Fri, 18 Oct 2024 08:45:12 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 adsct
t.co/i/ 43 B
626 B 179ms
93ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=d0b6f55e-2e38-4f34-b368-c3eecdc421ec&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7c66e6ae-8098-4976-a325-18fb9c4af6e1&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 304c543fe51ff9e0
cache-control: no-cache, no-store, max-age=0
x-connection-hash: d91d8fbc5988ebdbe28b13f2d5c1cd7de6e65949ee2198d3dcc44a7968d224a8
cf-cache-status: DYNAMIC
cf-ray: 8d47403b3f40726b-EWR
x-response-time: 5
content-length: 43
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
215 B 205ms
117ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=d0b6f55e-2e38-4f34-b368-c3eecdc421ec&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7c66e6ae-8098-4976-a325-18fb9c4af6e1&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: edd4fe48b05c3250
cache-control: no-cache, no-store, max-age=0
x-connection-hash: f4c2a09b6ffab59dcac11b73a753c880a0270318befd664eb809b985ba3a11ea
x-response-time: 79
content-length: 43
date: Fri, 18 Oct 2024 08:45:12 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 adsct
t.co/i/ 43 B
464 B 144ms
132ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=ff3f031c-d257-43d8-8966-f7d9094e16c8&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7c66e6ae-8098-4976-a325-18fb9c4af6e1&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: e3b2c71527b6a701
cache-control: no-cache, no-store, max-age=0
x-connection-hash: aeb9f274d7920b48f49b6636262dd90740479d317946fb350d6b36a1fc23cea0
cf-cache-status: DYNAMIC
cf-ray: 8d47403b7f4f726b-EWR
x-response-time: 6
content-length: 43
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
392 B 127ms
55ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=ff3f031c-d257-43d8-8966-f7d9094e16c8&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7c66e6ae-8098-4976-a325-18fb9c4af6e1&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: e3108ba68217573a
cache-control: no-cache, no-store, max-age=0
x-connection-hash: f4c2a09b6ffab59dcac11b73a753c880a0270318befd664eb809b985ba3a11ea
x-response-time: 5
content-length: 43
date: Fri, 18 Oct 2024 08:45:12 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H/1.1 200
OK tracking Show response
tracking.contanuity.com/ 2 B
769 B 432ms
155ms Script
application/json 54.203.236.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.contanuity.com/tracking?visitorId=d6537317bffb3b903736e7239c156559_1729241112418&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.203.236.163 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-203-236-163.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 18 Oct 2024 08:45:13 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
333 B 41ms
29ms XHR
text/plain 52.22.110.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=NZlTqtu9vowXrexrDZrWUA&is_js=true&landing_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&t=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&tip=Pu2mPClHsZ9QxffVYmQsHtA6K9sNAJRAPWxim0vtkV4&host=https%3A%2F%2Fwww.fortinet.com&sa_conv_data_css_value=%270-37caa182-e78d-5ac3-53c1-f42f4a530c94%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd937caa182e78d5ac353c1f42f4a530c94d0fc5070&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIMY-Drqccfbj5Pq5s45ZJzO-8W6Ynl4boev7oCXq2l6HEAEYAyCYwMi4BjABOgRA3giLQgTQjPkU.Q%252F8iEEq%252FNCaOOdBEqN1nxhlqqGJNmGwehps0FDmfb3Y&sa-user-id-v2=s%253AN8qhgueNWsNTwfQvSlMMlND8UHA.d7eMNETok8iMFbU9HkBXm9UQA7cc1VCqpDDNZffqpTw&sa-user-id=s%253A0-37caa182-e78d-5ac3-53c1-f42f4a530c94.5xzexlhfAoCszmXpL0eS%252B16dRyChPAl5Nlj%252FmqKz9GA
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.110.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-110-67.compute-1.amazonaws.com
Software: /
Resource Hash: e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
content-length: 138
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 tag.aspx Show response
ml314.com/ 38 KB
39 KB 153ms
35ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?179
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
etag: "632616ff15825f030aab3391a58ef042"
age: 1071
x-goog-stored-content-encoding: identity
x-cache-hit: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39162
date: Fri, 18 Oct 2024 08:27:22 GMT
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
content-type: application/javascript
x-guploader-uploadid: AHmUCY3olTYwYbThT4oVJ7Vb2Te0gOC-PEKw9il8MrL6xQIoPjRSzU6G0mamt0PLT8-O2ErgJ0qsSmEUug
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
cache-id: LGA-12baf686
accept-ranges: bytes
x-goog-generation: 1721849450340665
content-length: 39162
server: UploadServer

GET
H2 200 image.aspx
6033413.global.siteimproveanalytics.io/ 34 B
149 B 179ms
44ms Image
image/gif 54.86.120.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6033413.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&res=1600x1200&accountid=6033413&rt=3239&prev=77563a78-61c3-9edb-b2a7-84f79ef09a38&luid=7ba5ab6d-565e-77d7-1185-19dbdad7208d&rnd=24933
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.86.120.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-86-120-18.compute-1.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: Fri, 18 Oct 2024 08:45:13 UTC
cache-control: max-age=0
content-length: 34
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: image/gif

GET
H3 200 177020962864941 Show response
connect.facebook.net/signals/config/ 66 KB
13 KB 29ms
29ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.172&r=stable&domain=www.fortinet.com&hme=d82868061a8c707cd31395a3055e7449daa03bd520872727258c39e6af34523e&ex_m=70%2C120%2C106%2C110%2C61%2C4%2C99%2C69%2C16%2C96%2C88%2C51%2C54%2C171%2C174%2C186%2C182%2C183%2C185%2C29%2C100%2C53%2C77%2C184%2C166%2C169%2C179%2C180%2C187%2C130%2C41%2C34%2C142%2C15%2C50%2C193%2C192%2C132%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C92%2C17%2C14%2C95%2C91%2C90%2C107%2C52%2C109%2C39%2C108%2C30%2C93%2C26%2C167%2C170%2C139%2C85%2C56%2C83%2C33%2C73%2C0%2C94%2C32%2C28%2C82%2C87%2C47%2C46%2C86%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C101%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C103%2C102%2C104%2C97%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C89%2C81%2C44%2C35%2C84%2C2%2C36%2C63%2C42%2C105%2C45%2C79%2C68%2C111%2C60%2C59%2C31%2C98%2C58%2C55%2C49%2C78%2C72%2C24%2C112

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0d968e7c57781ed6db034f945eeb2dcd7144e11472d4cb03aaed614c1615e728

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 08:45:12 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=30, rtx=0, c=74, mss=1232, tbw=68961, tp=66, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: 3mjzprItCAoVf7McjD04XwtSm565kS3rLy9CVrFs4mkVDiUwzt/XyB70YXHQyED2KZl5+qmLsHk89B2IpKHNjQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 13189
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 138ms
45ms Image
text/plain 2a03:2880:f103:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&rl=&if=false&ts=1729241112943&sw=1600&sh=1200&v=2.9.172&r=stable&ec=0&o=4126&fbp=fb.1.1729241112941.56933520300194936&ler=empty&cdl=API_unavailable&it=1729241112899&coo=false&exp=h2&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=0, c=10, mss=1392, tbw=2948, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 223ms
131ms Image
image/png 2a03:2880:f103:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&rl=&if=false&ts=1729241112943&sw=1600&sh=1200&v=2.9.172&r=stable&ec=0&o=4126&fbp=fb.1.1729241112941.56933520300194936&ler=empty&cdl=API_unavailable&it=1729241112899&coo=false&exp=h2&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7427034028821981414"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xf77e856888256f1c","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"3":["1473595392721544"]},"debug_reporting":true,"debug_key":"3702575779969162783"}
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: Kp3XTQbnnsUTJ1ozM7QNWqc+ZQmJ1gd/fUC7UfecKH3MU6U0QpBJdZulYc7N0duQfcX8JluEpJ/2K1dcN+hdCA==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7427034028821981414", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=0, c=10, mss=1392, tbw=3265, tp=-1, tpl=-1, uplat=84, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 utsync.ashx Show response
ml314.com/ 641 B
1 KB 86ms
85ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&pv=1729241113048_60rcxc0ch&bl=en-us&cb=2356459&return=&ht=&d=&dc=&si=1729241113048_60rcxc0ch&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?179
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 08e00b414fbe088f51b95e3935a84634443dff2e509fa7ac7b5688d389d33e07

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: application/javascript
server: Google Frontend

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 31ms
31ms Image
image/gif 23.212.251.6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0f9de8e0-1609-40df-8e9c-b0f81ae9c572&session=d2225a5f-afe5-4d95-8e4b-3089d24365dd&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A12%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%222009%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&pageViewId=bc502bad-94cd-4b72-895e-a636cfa2b1bf&ipv6=2600%3A803%3Aa88%3A3112%3A%3A112&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.251.6 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-212-251-6.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 08:45:13 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 ibs:dpid=22052&dpuuid=3647789467281391627&redir=
dpm.demdex.net/ 42 B
716 B 33ms
31ms Image
image/gif 18.206.129.203
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3647789467281391627&redir=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.206.129.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-206-129-203.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v066-0c7beda70.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: iWkRHAbWTug=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: image/gif

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3647789467281391627
https://ml314.com/csync.ashx?fp=d095780446aa7b529920a94aed4c7fed5862c83b621884cae81f4bff5b0bc893f4cb09cee1a4f8eb&person_id=3647789467281391627&eid=50082

43 B
56 B

63ms
63ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=d095780446aa7b529920a94aed4c7fed5862c83b621884cae81f4bff5b0bc893f4cb09cee1a4f8eb&person_id=3647789467281391627&eid=50082
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Sat, 19 Oct 2024 08:45:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://ml314.com/csync.ashx?fp=d095780446aa7b529920a94aed4c7fed5862c83b621884cae81f4bff5b0bc893f4cb09cee1a4f8eb&person_id=3647789467281391627&eid=50082
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Fri, 18 Oct 2024 08:45:13 GMT

GET
H3

200

utsync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=bf1695df-b56f-461e-9ce8-bca196ab62dd&gdpr=0&gdpr_consent=

43 B
61 B

56ms
56ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=bf1695df-b56f-461e-9ce8-bca196ab62dd&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0,Sat, 19 Oct 2024 08:45:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

location: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=bf1695df-b56f-461e-9ce8-bca196ab62dd&gdpr=0&gdpr_consent=
content-length: 241
date: Fri, 18 Oct 2024 08:45:13 GMT
server: Kestrel

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3647789467281391627%26eid=2
https://ml314.com/csync.ashx?fp=8373965572602634997&person_id=3647789467281391627&eid=2

43 B
56 B

65ms
64ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=8373965572602634997&person_id=3647789467281391627&eid=2
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Sat, 19 Oct 2024 08:45:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-store, no-cache, private
location: https://ml314.com/csync.ashx?fp=8373965572602634997&person_id=3647789467281391627&eid=2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 208.252.80.112; 208.252.80.112; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: e37a3d86-e566-4d89-80dc-b3c64eb51293
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Oct 2024 08:45:13 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2gwHGZWm4U_RW2tdlfKEHEQasb4vZib_v9_QXfCyVzSU&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

70 B
440 B

30ms
29ms

Image
image/gif

44.196.77.126
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Protocol: HTTP/1.1
Server: 44.196.77.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-77-126.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 18 Oct 2024 08:45:13 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
pragma: no-cache
via: 1.1 google
expires: 0,Sat, 19 Oct 2024 08:45:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
content-length: 43
date: Fri, 18 Oct 2024 08:45:13 GMT
content-type: image/gif
x-cloud-trace-context: b4c9b327f93ab86d73cffdffcec5a377
server: Google Frontend

GET

usersync
tracking.contanuity.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d6537317bffb3b903736e7239c156559_1729241112418
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d6537317bffb3b903736e7239c156559_1729241112418&_bee_ppp=1
https://tracking.contanuity.com/usersync?bwcookie=AAN3W07OJEAAABsbq2fDhQ

0
0

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
198 B 44ms
40ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: D66537B8B92F442A97B4664FE9E17C55 Ref B: PHL30EDGE0114 Ref C: 2024-10-18T08:45:13Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYkvFJJ/s1kn/6g+ISgSw==
x-li-proto: http/2
access-control-allow-origin: https://www.fortinet.com
x-cache: CONFIG_NOCACHE
date: Fri, 18 Oct 2024 08:45:12 GMT
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 41ms
41ms Image
image/gif 23.212.251.6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0f9de8e0-1609-40df-8e9c-b0f81ae9c572&session=d2225a5f-afe5-4d95-8e4b-3089d24365dd&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A13%20GMT%22%2C%22timeSpent%22%3A%221009%22%2C%22totalTimeSpent%22%3A%223018%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&pageViewId=bc502bad-94cd-4b72-895e-a636cfa2b1bf&ipv6=2600%3A803%3Aa88%3A3112%3A%3A112&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.251.6 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-212-251-6.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 08:45:14 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 18 Oct 2024 08:45:14 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 3 KB
2 KB 538ms
106ms Script
application/javascript 52.89.99.220
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1465091660.1729241111&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729241111%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729241111%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221465091660.1729241111%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729241111.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22yEJG6%2Fbkydq9pDtFjjlhIDW4ixFsoCcw%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729241111.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729241111%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729241111%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cb=98200101172237360term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cb=98200101172237360term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.89.99.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-89-99-220.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: d907a25c3d3f8d6999421726830d30d257ff947854d3770413e56b722eed8021

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 17
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 18 Oct 2024 08:45:15 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 43ms
42ms Image
image/gif 23.212.251.6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0f9de8e0-1609-40df-8e9c-b0f81ae9c572&session=d2225a5f-afe5-4d95-8e4b-3089d24365dd&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A14%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%224021%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&pageViewId=bc502bad-94cd-4b72-895e-a636cfa2b1bf&ipv6=2600%3A803%3Aa88%3A3112%3A%3A112&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.251.6 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-212-251-6.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 08:45:15 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 18 Oct 2024 08:45:15 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK gs Show response
gs.mountain.com/ 144 B
734 B 501ms
184ms Script
application/javascript 35.81.162.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gs.mountain.com/gs
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1465091660.1729241111&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729241111%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729241111%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221465091660.1729241111%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729241111.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22yEJG6%2Fbkydq9pDtFjjlhIDW4ixFsoCcw%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729241111.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729241111%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729241111%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cb=98200101172237360term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.81.162.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-81-162-201.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 6d1cd8be1246c1e5ff08404f5b7fe63e81c1ea12ca4df670baf723adab7c43a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 93
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 18 Oct 2024 08:45:15 GMT
content-length: 144
content-type: application/javascript;charset=utf-8
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H/1.1 200
OK st Show response
px.mountain.com/ 6 KB
2 KB 375ms
174ms Script
application/javascript 52.89.99.220
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1465091660.1729241111&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729241111%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729241111%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221465091660.1729241111%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729241111.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22yEJG6%2Fbkydq9pDtFjjlhIDW4ixFsoCcw%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729241111.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729241111%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729241111%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue&cb=1729241115056717&shguid=82a265b0-de4a-3e7c-8b10-15946704285b&shgts=1729241115558
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1465091660.1729241111&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729241111%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729241111%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221465091660.1729241111%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729241111.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22yEJG6%2Fbkydq9pDtFjjlhIDW4ixFsoCcw%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729241111.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729241111%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729241111%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&cb=98200101172237360term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.89.99.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-89-99-220.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: c7af0ebb0afd3debb934b53e469abac830698b05629944bf79ea0ff4d2699f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 82
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 18 Oct 2024 08:45:15 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H/1.1

200
OK

tdsync
px.steelhousemedia.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=4b71ab47-8d2d-11ef-88ff-d5a1d54a5160&gdpr=&gdpr_consent=
https://px.steelhousemedia.com/tdsync?tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd&shguid=4b71ab47-8d2d-11ef-88ff-d5a1d54a5160

0
319 B

475ms
158ms

Image
text/plain

44.225.29.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.steelhousemedia.com/tdsync?tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd&shguid=4b71ab47-8d2d-11ef-88ff-d5a1d54a5160
Protocol: HTTP/1.1
Server: 44.225.29.129 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-225-29-129.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 70
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Fri, 18 Oct 2024 08:45:16 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

Redirect headers

location: https://px.steelhousemedia.com/tdsync?tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd&shguid=4b71ab47-8d2d-11ef-88ff-d5a1d54a5160
content-length: 277
date: Fri, 18 Oct 2024 08:45:16 GMT
server: Kestrel

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3
https://dpm.demdex.net/ibs:dpid=903&dpuuid=bf1695df-b56f-461e-9ce8-bca196ab62dd&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=8373965572602634997&ttd_tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YmYxNjk1ZGYtYjU2Zi00NjFlLTljZTgtYmNhMTk2YWI2MmRk&gdpr=0&gdpr_consent=&ttd_tdid=bf1695df-b56f-461e-9ce8-bca19...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=bf1695df-b56f-461e-9ce8-bca196ab62dd&google_gid=CAESENYEXxEFzQm-ulmYBoP0Iks&google_cver=1
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=bf1695df-b56f-461e-9ce8-bca196ab62dd&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=bf1695df-b56f-461e-9ce8-bca196ab62dd&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D2c4539d9-151c-427f-825b-81eed58693d5%252Chttps%2525...
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=8373965572602634997&pt=2c4539d9-151c-427f-825b-81eed58693d5%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad

70 B
496 B

29ms
29ms

Image
image/gif

52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
Protocol: H2
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-length: 70
date: Fri, 18 Oct 2024 08:45:16 GMT
content-type: image/gif
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Fri, 18 Oct 2024 08:45:16 GMT
server: Jetty(11.0.13)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 43ms
42ms Image
image/gif 23.212.251.6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0f9de8e0-1609-40df-8e9c-b0f81ae9c572&session=d2225a5f-afe5-4d95-8e4b-3089d24365dd&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225022%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&pageViewId=bc502bad-94cd-4b72-895e-a636cfa2b1bf&ipv6=2600%3A803%3Aa88%3A3112%3A%3A112&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.251.6 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-212-251-6.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 08:45:16 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 18 Oct 2024 08:45:16 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET img.gif
b.6sc.co/v1/beacon/ 0
0

GET /
webtracker.argusplatform.com/wh/track/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ad.doubleclick.net
URL: https://ad.doubleclick.net/activity;register_conversion=1;src=10050195;npa=0;auiddc=2122270218.1729241111;ps=1;pcor=722495477;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Domain: pixels.argusplatform.com
URL: https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1729241112513836682&event_type=page_request&timestamp=1729241112&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&page_url_referer=

Domain: ups.analytics.yahoo.com
URL: https://ups.analytics.yahoo.com/ups/55964/sync?uid=6BB12C5AB7134149BD3FA0941DCF4618&verify=true

Domain: tracking.contanuity.com
URL: https://tracking.contanuity.com/usersync?bwcookie=AAN3W07OJEAAABsbq2fDhQ

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=0f9de8e0-1609-40df-8e9c-b0f81ae9c572&session=d2225a5f-afe5-4d95-8e4b-3089d24365dd&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2018%20Oct%202024%2008%3A45%3A16%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%226022%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&pageViewId=bc502bad-94cd-4b72-895e-a636cfa2b1bf&ipv6=2600%3A803%3Aa88%3A3112%3A%3A112&v=1.1.29

Domain: webtracker.argusplatform.com
URL: https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1729241112513836682&event_type=page_request&timestamp=1729241118&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&page_url_referer=

Verdicts & Comments Add Verdict or Comment

169 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

125 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-21 09:06:17	Name: cookiesession1 Value: 678A3E59688E40A9EC1247ABAEE9E8FD
.fortinet.com/	1970-01-21 09:06:17	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Thu+Oct+17+2024+22%3A45%3A10+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=6.10.0&hosts=&consentId=aa12dc97-d57a-436f-82d4-e03edaf93e10&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.fortinet.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-21 04:39:53	Name: demdex Value: 34358979600019794372491219540831009332
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
.simpli.fi/	1970-01-21 09:07:43	Name: suid Value: 6BB12C5AB7134149BD3FA0941DCF4618
www.fortinet.com/	1970-01-21 09:56:41	Name: _gd_visitor Value: 0f9de8e0-1609-40df-8e9c-b0f81ae9c572
www.fortinet.com/	1970-01-21 00:20:55	Name: _gd_session Value: d2225a5f-afe5-4d95-8e4b-3089d24365dd
.fortinet.com/	1970-01-21 02:30:17	Name: _gcl_au Value: 1.1.2122270218.1729241111
.fortinet.com/	1970-01-21 09:56:41	Name: _ga_38BQ9XFDT4 Value: GS1.1.1729241111.1.0.1729241111.0.0.0
.fortinet.com/	1970-01-21 09:56:41	Name: _ga Value: GA1.1.1465091660.1729241111
.fortinet.com/	1970-01-21 00:20:42	Name: mboxEdgeCluster Value: 34
.fortinet.com/	1970-01-21 09:56:41	Name: mbox Value: session#9b1ffeb8d4644de0bc12393b4925e7eb#1729242972\|PC#9b1ffeb8d4644de0bc12393b4925e7eb.34_0#1792485912
www.fortinet.com/	1970-01-21 00:20:41	Name: dicbo_id Value: %7B%22dicbo_fetch%22%3A1729241111235%7D
.fortinet.com/	1970-01-21 00:22:07	Name: _uetsid Value: 492b04908d2d11efa95ec7e2fd51a765
.fortinet.com/	1970-01-21 09:42:17	Name: _uetvid Value: 492b19f08d2d11efb4535bf432ab7675
.bing.com/	1970-01-21 09:42:17	Name: MUID Value: 1C21DEB89C4B670C2160CBA49D246641
.bat.bing.com/	1970-01-21 00:30:45	Name: MR Value: 0
.dpm.demdex.net/	1970-01-21 04:39:53	Name: dpm Value: 34358979600019794372491219540831009332
.fortinet.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.fortinet.com/	1970-01-21 09:56:41	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 179643557%7CMCIDTS%7C20015%7CMCMID%7C33982131931045165172455786578050309052%7CMCAAMLH-1729845910%7C7%7CMCAAMB-1729845910%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1729248310s%7CNONE%7CMCSYNCSOP%7C411-20022%7CvVersion%7C5.5.0
www.fortinet.com/	1970-01-21 09:56:41	Name: _omappvp Value: UWMXUmTurat1zaCAvbACzkQ3zXMh1ELgQ2F8PvQYIsnZ4ruvACydP4kUFI0ny4Lxd9iMD6CprELx991ORfB3yagpRcCeuOFy
www.fortinet.com/	1970-01-21 00:20:42	Name: _omappvs Value: 1729241111538
.doubleclick.net/	1970-01-21 09:56:41	Name: IDE Value: AHWqTUkHSRncoLLBjydqsIYc__3vRtOUNUIeJbRBgU4iqTV_hVuOIuoaA-vOACMi
.fortinet.com/	1970-01-21 00:20:42	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa%23new_tab
.fortinet.com/	1970-01-21 02:30:17	Name: s_getNewRepeat Value: 1729241111654-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.techtarget.com/	1970-01-21 00:20:42	Name: __cf_bm Value: 2An1YMi.nWniDTC1_GtmDL7U_XWrXOnQkbJsFhEinSE-1729241111-1.0.1.1-8Y0ruEkNVurYnktLlxDEwTkdzxzSIy0.0V4HVnVGic11bx6.lCqzTKuQaDt5wjwnEbCcfJz.P.zbpz3zok02cA
.fortinet.com/	1970-01-21 09:56:41	Name: _ga_JH142QCQCJ Value: GS1.1.1729241111.1.0.1729241111.0.0.0
.www.fortinet.com/	1970-01-21 09:06:17	Name: WID_VISITOR_ID Value: 1729241112513836682
.doubleclick.net/	1970-01-21 04:39:53	Name: receive-cookie-deprecation Value: 1
.fortinet.com/	1970-01-21 00:22:07	Name: _ce.clock_data Value: 44%2C208.252.80.112%2C1%2Ccd70ceeb4a1768030b1882c90242a428%2CChrome%2CUS
.fortinet.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.fortinet.com/	1970-01-21 09:06:17	Name: _ce.s Value: v~b0add7076acc9815bddeb51cfbbe3c523f7bca3e~lcw~1729241111892~vir~new~lva~1729241111520~vpv~0~v11.cs~424000~v11.s~498eba30-8d2d-11ef-b42b-ff3416b3ac87~lcw~1729241111893
www.fortinet.com/	1970-01-21 00:30:45	Name: AWSALB Value: PcQnk7reG4ubP3OyHLYvW9EiGhop+VPWdgRdF81+fP4qNhpn2S7HsG++1k/GBC9AlqtLROmtw3fJtcgcBfvEZV8NLZAYiCHAVHuc+GpKN9yiH+a9U1vdADfJFKosWbrRRXorgNYPE46mWVARjRzQho5dpvTRFunKBx/tF15tgCAUCChyss/XnBU8cOWlulHcUD3MfdJ9oBiLEqh2xdO9bkz3rIT2q7lp
www.fortinet.com/	1970-01-21 00:30:45	Name: AWSALBCORS Value: dcKjhuByWQE3XmEaumNb9LbYuBeTlTaSoCs55OolhyLnJjllSXVC3VfUcPlmcR5dvaMi8XFWXrtUFVrdwZLuq+sdsdrTcWBciucWevNLyjYhG5UtbqVJKlRRAOCaCmn4ZpCDqac5Y6J6SKExH8K9L07BXlbQ9E8K9uTB/NMdcJU4nHyTVkRntF2zc5736MofJyErQNzPpD/pIY6wU7JnKKJm8Ru0m+VB
.simpli.fi/	1970-01-21 00:30:45	Name: uid_syncd_secure Value: true
.adnxs.com/	1970-01-21 09:56:41	Name: receive-cookie-deprecation Value: 1
tags.srv.stackadapt.com/	1970-01-21 09:06:17	Name: sa-user-id Value: s%3A0-37caa182-e78d-5ac3-53c1-f42f4a530c94.5xzexlhfAoCszmXpL0eS%2B16dRyChPAl5Nlj%2FmqKz9GA
.srv.stackadapt.com/	1970-01-21 09:06:17	Name: sa-user-id Value: s%3A0-37caa182-e78d-5ac3-53c1-f42f4a530c94.5xzexlhfAoCszmXpL0eS%2B16dRyChPAl5Nlj%2FmqKz9GA
tags.srv.stackadapt.com/	1970-01-21 09:06:17	Name: sa-user-id-v2 Value: s%3AN8qhgueNWsNTwfQvSlMMlND8UHA.d7eMNETok8iMFbU9HkBXm9UQA7cc1VCqpDDNZffqpTw
.srv.stackadapt.com/	1970-01-21 09:06:17	Name: sa-user-id-v2 Value: s%3AN8qhgueNWsNTwfQvSlMMlND8UHA.d7eMNETok8iMFbU9HkBXm9UQA7cc1VCqpDDNZffqpTw
tags.srv.stackadapt.com/	1970-01-21 09:06:17	Name: sa-user-id-v3 Value: s%3AAQAKIMY-Drqccfbj5Pq5s45ZJzO-8W6Ynl4boev7oCXq2l6HEAEYAyCYwMi4BjABOgRA3giLQgTQjPkU.Q%2F8iEEq%2FNCaOOdBEqN1nxhlqqGJNmGwehps0FDmfb3Y
.srv.stackadapt.com/	1970-01-21 09:06:17	Name: sa-user-id-v3 Value: s%3AAQAKIMY-Drqccfbj5Pq5s45ZJzO-8W6Ynl4boev7oCXq2l6HEAEYAyCYwMi4BjABOgRA3giLQgTQjPkU.Q%2F8iEEq%2FNCaOOdBEqN1nxhlqqGJNmGwehps0FDmfb3Y
www.fortinet.com/	1970-01-21 09:06:17	Name: sa-user-id Value: s%253A0-37caa182-e78d-5ac3-53c1-f42f4a530c94.5xzexlhfAoCszmXpL0eS%252B16dRyChPAl5Nlj%252FmqKz9GA
www.fortinet.com/	1970-01-21 09:06:17	Name: sa-user-id-v2 Value: s%253AN8qhgueNWsNTwfQvSlMMlND8UHA.d7eMNETok8iMFbU9HkBXm9UQA7cc1VCqpDDNZffqpTw
www.fortinet.com/	1970-01-21 09:06:17	Name: sa-user-id-v3 Value: s%253AAQAKIMY-Drqccfbj5Pq5s45ZJzO-8W6Ynl4boev7oCXq2l6HEAEYAyCYwMi4BjABOgRA3giLQgTQjPkU.Q%252F8iEEq%252FNCaOOdBEqN1nxhlqqGJNmGwehps0FDmfb3Y
.adnxs.com/	1970-01-21 02:30:17	Name: XANDR_PANID Value: jgFxNTzI2d90Fta65LpvMjXCQUD4sq_6l7RZZ02bzppwndr8msXAI-gbGhiQM2r3UygiQjyh3FiccLdzO3xiC11bq66WS1iyHOatH74qWxw.
.adnxs.com/	1970-01-21 02:30:17	Name: uuid2 Value: 8373965572602634997
abm-tracking.demandscience.com/	1970-01-21 09:56:41	Name: userId Value: d6537317bffb3b903736e7239c156559_1729241112418
.adnxs.com/	1970-01-21 02:30:17	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2GU^DL)hz!@wnfH8KW.dG5<#Z0wLLE<'CqOHgwFTd0pDi5wdr/mymFp%?hqy3cAFLbncpo*N(j#iP(Md+>)fy)nJZJXS
.smaato.net/	1970-01-21 00:50:55	Name: SCM Value: f1c15edd4b
.smaato.net/	1970-01-21 00:50:55	Name: SCMo Value: f1c15edd4b
.smaato.net/	1970-01-21 00:50:55	Name: SCM1001136 Value: f1c15edd4b
.3lift.com/	1970-01-21 02:30:17	Name: tluidp Value: 763072012147411282105
.3lift.com/	1970-01-21 02:30:17	Name: tluid Value: 763072012147411282105
.pubmatic.com/	1970-01-21 01:03:53	Name: KRTBCOOKIE_148 Value: 19421-uid:6BB12C5AB7134149BD3FA0941DCF4618&KRTB&23486-uid:6BB12C5AB7134149BD3FA0941DCF4618&KRTB&23489-uid:6BB12C5AB7134149BD3FA0941DCF4618&KRTB&23539-uid:6BB12C5AB7134149BD3FA0941DCF4618
.pubmatic.com/	1970-01-21 01:03:53	Name: PugT Value: 1729241112
.tapad.com/	1970-01-21 01:47:05	Name: TapAd_TS Value: 1729241112737
.tapad.com/	1970-01-21 01:47:05	Name: TapAd_DID Value: 2c4539d9-151c-427f-825b-81eed58693d5
.agkn.com/	1970-01-21 09:06:17	Name: ab Value: 0001%3ARhz%2F9dU7KN%2Fq21SLRqmGX%2BOemi1z4c2L
.exelator.com/	1970-01-21 03:13:29	Name: EE Value: "3c8ae490e6760b356680ba2a149d879e"
.openx.net/	1970-01-21 09:06:17	Name: i Value: f282533b-9069-4009-9126-aeccc326885d\|1729241112
.lijit.com/	1970-01-21 09:06:17	Name: ljt_reader Value: JhCNAQZHbcP0gHbOS-GYuw0x
.crwdcntrl.net/	1969-12-31 23:59:59	Name: _cc_cc Value: ctst
www.fortinet.com/	1970-01-21 00:22:09	Name: aa_cc Value: US
www.fortinet.com/	1970-01-21 00:22:09	Name: aa_cn Value: United%20States
.linkedin.com/	1970-01-21 02:30:17	Name: li_sugr Value: 8b7797c5-4742-41e9-b562-4f4d15b7e123
.linkedin.com/	1970-01-21 09:06:17	Name: bcookie Value: "v=2&14dbd7e8-efa7-4c42-8af5-c812a2d37306"
.linkedin.com/	1970-01-21 00:22:07	Name: lidc Value: "b=VGST08:s=V:r=V:a=V:p=V:g=3045:u=1:x=1:i=1729241112:t=1729327512:v=2:sig=AQESux9pL41Powwk8rFMSuK1q1og9hVs"
.intentiq.com/	1970-01-21 09:56:41	Name: intentIQ Value: aULjUBa2IT
.intentiq.com/	1970-01-21 09:56:41	Name: IQver Value: 1.9
www.fortinet.com/	1970-01-21 00:22:09	Name: 6scexist Value: true
.bfmio.com/	1970-01-21 09:06:17	Name: __141_cid Value: 6BB12C5AB7134149BD3FA0941DCF4618
.bfmio.com/	1970-01-21 09:06:17	Name: __io_cid Value: 7824af3e5f810cdcde35ce694bd094c568351ad1
.rubiconproject.com/	1970-01-21 09:06:17	Name: khaos Value: M2EHIE3H-W-L4M7
.rubiconproject.com/	1970-01-21 09:06:17	Name: khaos_p Value: M2EHIE3H-W-L4M7
.rubiconproject.com/	1970-01-21 02:30:17	Name: receive-cookie-deprecation Value: 1
.ads.stickyadstv.com/	1970-01-21 01:03:53	Name: UID Value: b77e3db39ffc856a975a11651ea7a7a
.ads.stickyadstv.com/	1970-01-21 00:22:07	Name: uid-bp-26865 Value: 6BB12C5AB7134149BD3FA0941DCF4618
.fortinet.com/	1970-01-21 09:56:41	Name: nmstat Value: 77563a78-61c3-9edb-b2a7-84f79ef09a38
.yahoo.com/	1970-01-21 09:06:38	Name: A3 Value: d=AQABBBggEmcCEPxjrz1FgchB9QVZhQ1KmmoFEgEBAQFxE2ccZ9xH0iMA_eMAAA&S=AQAAAmwFUj-GqnejURok7mqMDkY
.pro-market.net/	1970-01-21 01:03:53	Name: anHistory Value: "-1jojfl3lv7hgr+2+!#7')%<!Y1g"
.exelator.com/	1970-01-21 03:13:29	Name: ud Value: "eJxrXxzq6XKLQcE42SIx1cTSINXM3MwgydjUzMzCICnRKNHQxDLFwtwydXFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDIckl%252BUWb6otDgxUUpaQyLSopPBZ%252F0TwcAhzEp4w%253D%253D"
.lijit.com/	1970-01-21 09:06:17	Name: _ljtrtb_2 Value: 6BB12C5AB7134149BD3FA0941DCF4618
.intentiq.com/	1970-01-21 01:03:53	Name: IQMID Value: 3506196592#1729241112877
.intentiq.com/	1970-01-21 09:56:41	Name: CSDT Value: UEQ6MTAwNDNfMCZVUlhqVHZa
.intentiq.com/	1970-01-21 09:56:41	Name: intentIQCDate Value: 1729241112873
.intentiq.com/	1970-01-21 09:56:41	Name: IQPData Value: 3506196592#1729241112872#0#1729241112872
.intentiq.com/	1970-01-21 09:56:41	Name: ASDT Value: 0
.fortinet.com/	1970-01-21 02:30:17	Name: _fbp Value: fb.1.1729241112941.56933520300194936
.t.co/	1970-01-21 09:56:41	Name: muc_ads Value: 5cbc1d10-836a-43ff-b47a-5fc865797a2e
.t.co/	1970-01-21 00:20:42	Name: __cf_bm Value: dMH0GfCOHhbPyGJbGo85zQv1gC92k5faYMlQp8ayFMg-1729241112-1.0.1.1-nud.T0heUg_dZ7_9ucf7r9wmLAkj3cwf8Y8km_G.G6u6oMsedlG5UY8MI4uIMvmxZChyNLErn3w0f2YefjTYbw
.agkn.com/	1970-01-21 09:06:17	Name: u Value: C\|0AAAAAAAALqTcmAAAAAAA
.twitter.com/	1970-01-21 09:56:41	Name: personalization_id Value: "v1_ci0+fRn7mCbuIk41DR18vA=="
.linkedin.com/	1970-01-21 01:03:53	Name: UserMatchHistory Value: AQJjmUkvQwm9CwAAAZKezWGNUPq8tN_doWTqeNxHSGwooYGAD7xQ0XigcCWt6eMpKpS43huxjyLsKw
.linkedin.com/	1970-01-21 01:03:53	Name: AnalyticsSyncHistory Value: AQInBngHHbyedQAAAZKezWGN3Bb9sL7HCZMw7ux4kZAvEiqSVrld4cWyMxreUdevRHCl47AG5gFdTKibLRl8Iw
.pippio.com/	1970-01-21 09:06:17	Name: did Value: sXfmOSC-jbdb4qtH
.pippio.com/	1970-01-21 09:06:17	Name: didts Value: 1729241112
.pippio.com/	1970-01-21 01:47:05	Name: nnls Value:
.pippio.com/	1970-01-21 01:47:05	Name: pxrc Value: CJjAyLgGEgYIgr0rEAA=
.ml314.com/	1970-01-21 09:06:17	Name: pi Value: 3647789467281391627
.ml314.com/	1970-01-21 00:40:50	Name: tp Value: 4%253B10%252F18%252F2024%2B08%253A45%253A13
.analytics.yahoo.com/	1970-01-21 09:06:17	Name: IDSYNC Value: "176k~2lbk:19ba~2lbk"
.www.linkedin.com/	1970-01-21 09:06:17	Name: bscookie Value: "v=1&2024101808451303aeec20-6019-431e-8145-ab18f1a6baadAQH63OzhOAUoJqsfgCW7eifSYTeGbcLw"
.linkedin.com/	1970-01-21 00:20:42	Name: __cf_bm Value: 24Hmr2OV.np56dWAhDAwExV1Kn7SobZlCrhxPT52TZw-1729241113-1.0.1.1-ZwKyVVudY30lcvKC8ZV3UHKX.YTeLNwlcOf7Ko_4cu43WrTvUXH5D518SgNwm1oDwrNV5nof5W2ErS5KQomslA
.rlcdn.com/	1970-01-21 09:06:17	Name: rlas3 Value: BCAn+558vSEvVKbekdPdnULUU1h5YvlswIljqUuHvUg=
.rlcdn.com/	1970-01-21 01:47:05	Name: pxrc Value: CJjAyLgGEgUI6AcQABIFCOhHEAASBQjbThAB
.pro-market.net/	1970-01-21 04:39:53	Name: anProfile Value: "-1jojfl3lv7hgr+1+1f=1+1g=1+1j=57:1+rs=s+rt=260008030A8831120000000000000112+s2=(sljmzc)+vm=24-6BB12C5AB7134149BD3FA0941DCF4618:81-y-zdfmSYNE2pQwJggtR1GwOBUDLa7UNgQQihg-%7EA"
tracking.contanuity.com/	1970-01-21 09:56:41	Name: userId Value: d6537317bffb3b903736e7239c156559_1729241112418
tracking.contanuity.com/	1970-01-21 09:56:41	Name: clientId Value: undefined
.adsrvr.org/	1970-01-21 09:06:17	Name: TDID Value: bf1695df-b56f-461e-9ce8-bca196ab62dd
.eyeota.net/	1970-01-21 09:06:17	Name: mako_uid Value: 1929ecd62d9-3540000010a55fd
.eyeota.net/	1970-01-21 00:20:41	Name: SERVERID Value: 22013~DM
.doubleclick.net/	1970-01-21 01:03:53	Name: ar_debug Value: 1
.ml314.com/	1970-01-21 00:20:41	Name: u Value: aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLw%3D%3D
.bidr.io/	1970-01-21 09:49:14	Name: bito Value: AAN3W07OJEAAABsbq2fDhQ
.bidr.io/	1970-01-21 09:49:14	Name: bitoIsSecure Value: ok
.mountain.com/	1970-01-21 09:06:17	Name: guid Value: 4b71ab47-8d2d-11ef-88ff-d5a1d54a5160
.px.mountain.com/	1970-01-21 09:06:17	Name: tt Value: "H4sIAAAAAAAAAKtW8guKNzYyNjaLNzK3NFayMtBRgnItjC2UrAzNjSyNTAwNDU0tTM11lMqUrIx0kLSA1RjUAgA9plYCRgAAAA=="
.mountain.com/	1970-01-21 09:06:17	Name: rt Value: "MzIzMzY6MTcyOTI0MTExNQ=="
.rubiconproject.com/	1970-01-21 09:06:17	Name: audit_p Value: 1\|vVNK/waAb5FmvCy6C4NvK6ys6liPMWK1EJMprhhvSg7CWWOn7PymVozA5QhxblDjSPkMytWaA8SM1KxoLazIt04KBbjzRD/Y5dDZuxGLGk+/zDYaIgmdYXS82r0EavJjtKLCwhCOrBoaHm6ZaNWgOODrkP6FFP2YSpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.rubiconproject.com/	1970-01-21 09:06:17	Name: audit Value: 1\|vVNK/waAb5FmvCy6C4NvK6ys6liPMWK1EJMprhhvSg7CWWOn7PymVozA5QhxblDjSPkMytWaA8SM1KxoLazIt04KBbjzRD/Y5dDZuxGLGk+/zDYaIgmdYXS82r0EavJjtKLCwhCOrBoaHm6ZaNWgOODrkP6FFP2YSpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.tapad.com/	1970-01-21 01:47:05	Name: TapAd_3WAY_SYNCS Value: 2!7016
.adsrvr.org/	1970-01-21 09:06:17	Name: TDCPM Value: CAESFgoHZDB0cm8xahILCM7A4u7m1rc9EAUSEgoDYWFtEgsIkNHHqK2krD0QBRIXCghhcHBuZXh1cxILCIK6yYnn1rc9EAUSFQoGZ29vZ2xlEgsInMa9iufWtz0QBRIWCgdydWJpY29uEgsIivK9iufWtz0QBRIUCgV0YXBhZBILCJyViovn1rc9EAUYBTgBQgQiAggB

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://stags.bluekai.com/site/29931?id=6BB12C5AB7134149BD3FA0941DCF4618 Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
6033413.global.siteimproveanalytics.io
a.omappapi.com
a.opmnstr.com
aa.agkn.com
abm-tracking.demandscience.com
ad.doubleclick.net
ads.stickyadstv.com
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
b.6sc.co
bat.bing.com
bcp.crwdcntrl.net
c.6sc.co
cdn.cookielaw.org
cdn.jsdelivr.net
ce.lijit.com
cm.everesttech.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
connect.facebook.net
d.agkn.com
dpm.demdex.net
dx.mountain.com
eb2.3lift.com
eps.6sc.co
fei.pro-market.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
i.simpli.fi
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
image2.pubmatic.com
insight.adsrvr.org
intentstream.contanuity.com
ipv6.6sc.co
j.6sc.co
loadm.exelator.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
pbid.pro-market.net
pippio.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
pixels.argusplatform.com
ps.eyeota.net
px.ads.linkedin.com
px.mountain.com
px.steelhousemedia.com
px4.ads.linkedin.com
s.ad.smaato.net
script.crazyegg.com
secure.adnxs.com
simplifi.partners.tremorhub.com
siteimproveanalytics.com
snap.licdn.com
stags.bluekai.com
static.ads-twitter.com
sync.1rx.io
sync.bfmio.com
sync.intentiq.com
sync.outbrain.com
t.co
tag.simpli.fi
tags.inzynk.io
tags.srv.stackadapt.com
td.doubleclick.net
tmp.argusplatform.com
tr.outbrain.com
tracking.contanuity.com
tracking.crazyegg.com
trk.techtarget.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
wave.outbrain.com
webtracker.argusplatform.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
ad.doubleclick.net
b.6sc.co
pixels.argusplatform.com
tracking.contanuity.com
ups.analytics.yahoo.com
webtracker.argusplatform.com
104.244.42.67
107.178.254.65
108.138.128.44
13.107.42.14
142.250.31.148
146.75.76.157
162.159.140.229
173.194.205.157
18.206.129.203
18.216.31.172
2001:4998:60:807::1
2001:4998:60:807::2
207.65.37.184
209.85.144.149
216.200.232.249
23.212.251.6
23.220.132.230
23.62.165.92
2400:52e0:1a00::1207:2
2600:1408:c400:195::1e80
2600:1408:c400:5::17c7:3719
2600:1408:c400:d::17cd:6a47
2600:1901:0:8eee::
2600:1f18:1492:1701:a964:c08d:f5eb:b0c
2600:1f18:612b:4200:5e2b:8808:4329:7b7f
2600:9000:2073:7a00:1b:6b7d:2300:93a1
2600:9000:2141:6400:12:dfa9:e200:93a1
2600:9000:21f9:7200:19:fc2c:a140:93a1
2600:9000:2305:c800:1b:5138:8a40:93a1
2606:4700:3035::6815:3296
2606:4700:3108::ac42:2af8
2606:4700:4400::6812:2089
2606:4700:4400::ac40:92d7
2606:4700::6812:1347
2606:4700::6812:562a
2606:4700::6813:9308
2607:f8b0:4004:c1f::9d
2607:f8b0:400d:c0b::8a
2607:f8b0:400d:c0b::93
2607:f8b0:400d:c0d::9b
2607:f8b0:400d:c0f::61
2620:1ec:21::14
2620:1ec:33:1::10
2620:1ec:bdf::41
2a03:2880:f003:c0e:face:b00c:0:3
2a03:2880:f103:181:face:b00c:0:25de
2a04:4e42:400::485
34.111.113.62
34.111.208.231
34.117.77.79
34.193.229.172
34.206.151.111
34.229.3.43
34.86.110.8
35.194.66.159
35.244.154.8
35.244.159.8
35.71.139.29
35.81.162.201
44.196.77.126
44.212.189.233
44.225.29.129
44.226.187.177
52.22.110.67
52.223.40.198
52.32.164.86
52.34.176.237
52.7.151.245
52.89.99.220
54.159.21.67
54.203.236.163
54.85.187.162
54.86.120.18
63.140.39.45
63.140.39.65
63.251.28.211
64.202.112.191
64.233.180.156
68.67.161.182
68.67.161.208
69.173.146.5
69.194.240.13
75.2.108.141
08e00b414fbe088f51b95e3935a84634443dff2e509fa7ac7b5688d389d33e07
0968bbb30f1aef951bb770793756fca4fd75cce26bce318ace9c6e31deddf7f6
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0d968e7c57781ed6db034f945eeb2dcd7144e11472d4cb03aaed614c1615e728
0e0c8cedb72a7e5a3080203509132486e267e5d1b0c5c6eae78ac16f7928ff01
0e6e31465592638aaa036384d85ebd6e6c56b9178591bceea4a0b815dd06d535
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
0fb1f234509ab7b7cb8bd935b4b4e489e538c1986e77bb5f1a3ce7ddd598e229
13b70c5c4878d80d7366077cafdf5a4c2f4deab7d8b49916e955411c997c7557
146a4fab9c3295f3592d80aab8b3041223a682747c3491495ef7cf4132b7f321
17095b0dfaded492b73f4f6a30412ecb2f7a87a2ebd1f8963d5c5cee3db937bd
17234dc33fee83a6097588da7dc802864fd9af021ff0b48fa73a404e30aa362c
18041a7dd2be9d4ba5469edca86d5bd763e3bdcae7a83c5559c618bf4be83f0f
188c1c4378ca30c9eef2b446a37c4a7eb75d043f56acf32c35eb0077bb8705a6
18f5794db26670e34d8df06806be8536dc6520a380dcf67bced51fc8f7ef91e1
1a8491dacfaed6de53e20ff200c81255fb61def72f2696426a23ec5a05265b28
1ba342118d432fefd8e7dccfa482a162ee6b24b9be731aac2a4762eedd9ad823
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1d3e1ffd86a5653412775034689e08d77352a1a255038f3cf953b76318ac946a
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
2118826227dcf56e102ae9e89af0ba303aee0bc45ae1bfc4e4d29b1246ce58fb
22f9534fba4207e26d53d6181e49e4f00f34473ffaad6e5245af3daee739f780
2493fbbf9465c0041d1943806f94fd639157b03ead282fae2e22ae303944a15b
26b37b2982358112ad578340484a7de6274a19db3fb6ea13f0b4e2d89e35f566
29d6b32f545f36a29ab83a4be5f92d4ebfb43a6dcc6457f7681a8478e5e8ea6c
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e50f9ae9324af2e1d1803215dfa3b1e4476f62bf1c3d548743835992ca87182
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2fe9108e60e5eb58e132c65e26c89ca93158be701ae7033bafa5c6b3267b0b97
3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a
357c171eefe3fd37ea33c751ec6d06cde0adf0894ae54032a2663687d47f9b61
36186e198e296c76785020a85f35312fbf538fe48f96b8358b01c25cb5b673e8
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
384e04539a0724c84b3bee0e3d53fd76cc5069946de265e9153b9ad587c8d824
39a543197cee3bd0cac857a39467717e59781b5a8eec38ba40ebcc281e2c78b0
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fb6370c2aae6f63941faadef34260a95920ae6894d92e3cf1491b8963f9dd1c
3fc91c743a42a59c3f9c7a1f38416a09bfd75a112056e19aa79351827fa2cb77
42ca4de195dbfe6c66734969bcfe85fd62e7cb05b17b7888415f8989af398c92
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
443f47f0ae01cec5b4bc117dffb451485e147a54865efa7c820320e68cb55909
4829842a4a23cf9fae872ee9906320d1a7b4f4c282e6208c74f17a1b5bc27729
4aa70a752741f88840c0ae6612f71b6220ac77080c263caa1682cee47d9b39da
4af5dacf19bc195010075d202d98f083a444a8572cbc1711fe39225928cb6be1
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
5607bc0b49036b5f13acf3f5767e0fb2fb947f5369bda253939e78e2b11f85b4
59e58524340cd7ad353be010374b124c242fdde10a0ed41047fe2fd4bb9e5a2e
59ea071c19f22e30a783ae7ed96c2009fe39746b3fb77136746bf1d3a358a1ad
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5cde97a99252b4ad4fa0d3becd808a64e2b1946feef502515a47aab3f9110f7c
5fa043f0c7d87051071a76bfcd9a59a537991943ba96fde8cc718c5a0919b45b
61917dc4b13b887a30af978c934892e7db4329ba72bbd655635613b537d760e5
61af4356b1a56a808fbe79a6cd0f96444069b54d9eb1a1576b45c0e0f6bae0c5
643a52fac3e3aae163ef76ad0a2a088d2f31ac2552eff000edc1b495c8fbba32
644e98e4c6ce7519f77dc6c7401426d231c8f895f550c7f6c514bb4ec302ec6a
66a9e8a80c33a2f932441adf709f92aecca67782c8c0c5b1e165584d7eb3a291
6b2e250a402fc951cf47caa46780f7180ef6821dcbc24e80baf52fbc33703a30
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552
6d1cd8be1246c1e5ff08404f5b7fe63e81c1ea12ca4df670baf723adab7c43a9
6f105f6fa81f4cb957e1796190c897c9ab70d2c1fd15cc7a7aa778ee6cf95b88
701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f
717f11c79608856a33546a50fe20ac984c44c933ba23ea02c851f8f0004df1fd
727d19bf895438013bb188825e546dd6e61f80c2a4ea8e7b6e978b96bab546f4
72a16e82ebbe48c45ef6e2a67f4645444081d0cb72e09324824fc123fc30f6a0
741d8cc14f5aef46e2d47e5c8b0ea850563ba2b04fabb88b1a6201f6bb1ea43b
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
7c37b5d2c568700acb5aa4d6fc9ece9bc0df8882dc473d944a854ade711a696c
80979b936a389e029f1d96f9b57e39257416add377d59a14c91708c48cc60ae2
812483f0612cd7a2cabd76d954b56ec4e145e55c1ee89bfbf704801e368cd17a
8139798c3e25feafa256c3f781f37bdb81a86cfd551c5f010b6ef36cedd270d7
8230a81c3dd623e329a01eb7b84dc5155e8fd670f806f3856e1c5c22eaf46dfb
83fa138e4693e547cec48874c1258ffc1152b46a3f6df25a2e7099fec4a8af0d
85ff6d90fd5e9394262eb0cf336dd65c909254120191a048fddcade68ace23f0
872f233ef34c09bfa33644108af6f2dfce8f77a0e2dc0847882840355efc4820
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
8af6fb23ba1c0a4860476b240ba2d05c02ff018f1a93d2caadf7301ed87223d7
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8da358c85e9c21db0915f790c57a8c6650d81b8d112916934747fb25e4490fc2
8ef9e9b7103e38d4509a125612dad3ff98edfd671fa45f01d4d09c3cefa50a8f
8fa1b5cf3d89f86a6368b3e0dc98a87e859c98e9232f1f9a7bcb43036b52b439
92cfae0b0d343d93e5e1d365bb9179904e50407d803588ec009e2bb19e211ea3
930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6
931a1bc91c7b780d9df916bdbd551447e2b0d742a0ff1bdd7a6dbb5f42619b39
931ed055a12877ce15aa12c68d6d51b88aea90a2c98095f9a58441267b82a54b
933ddaeb7b389ab0803e3e7a1124cd51dcd097514e5e1cff4d4cef50b219779e
94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66
96fa0a3199b1184d9aab3b1a117e7b88974daff72641aee7f50b44f80d404aa4
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d
9b3beecd9e07624801f6302991b67619c53b88bacbd63e07dd1d2286842bd625
9f5da34f9af883822335cae8d65129b525249727f2f6d2277af00c28b520fee2
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a127f5d38a4a71d09b04fe89ab3c7cea05b5d20997a702855f66bcf3c0393cd5
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a364f8998ea88f243a482109d256626e8d7cb72a05eac69ac608c27435241a65
a42d5f034c99d5cef32cb878b42708bf7543cd8712dbe6174b8fd05cd362ba2d
a462bb85392ef235bc0ab080e8a9ae078a228fb74b3df156cb9f3ce7e20ad9e6
a4db214a51d8aa0b6a55aab329c983c0dba1976db88c499c75410392e220f9e5
a9a345b743fb7460be8d7e10ca085ea57901980b67d43151196d36f94a5451cb
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
abf599589c18766b9bea08b97863041c55bfa1ce6d62d5839b9bd60d5895504f
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad15ab06d640d365a00d41e146660addb01348b2f6878f6ffdc1dc428c67cc19
b0686aeb71d4a0db91943c4b697121f112b892c621bd36bd2f4321ab4015c5c1
b0b526b901a7afeac92efcd87a441305a26891bba8bfbb950f4b18f7fd582e59
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b14dd8572d41acd561188da5417cef18c475b3621a03be38f12fe100ef84a795
b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15
b3f4fd3661f04c2c6374215073e85cb8c5c938ee783677f40e85151989c39d97
b44b35c5eff8e5fdc0224ebecd76436608988dad0886ab4d5508a51de041af4d
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e
b69b5763c6c912b8a1852981c4401647963d63734e234b073d97c0dffbf64206
b89df263d3d532643cf924dd6833646f818fc82fca1cd3c1f5ebe0c53d68bc99
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
ba3439f9f07d32121ea36671828c9980e2af00de8f96443e343ab78069a7511c
bb13a80fdd4875e6626de9e2b4ebf7948f3cfe191f73b4dbf31e1247d0239667
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd6f701d7b3abd41679f87c496bc8911a602f247900dfc7ab7cb3a62abe098ee
bec3437c8baa45a6344648c2bb6806831972c5cdd7ae34a16897d6e205092476
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869
c52f6ff7a6d84e31cfbbe1df40a73422d6fb962fd36afba65e8a1ed9bcb9ff8c
c584b5d0f98a654a3857877fa1e3dbb85b0b0e779191ad952af4e14116205e2c
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86
c7af0ebb0afd3debb934b53e469abac830698b05629944bf79ea0ff4d2699f7d
c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cbe67b5b6fa27d2f9d4f18dba4f940ce8c4a3dbcab1541b5b1023ce4dcea66e0
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cff43ffcd3d9feaba4fb1250d800a3b9650a7f65c26f00b196e403cc763ee1d4
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d3cdd8255b0cabf4568ec33c19f12ef6a3a761ea27bb36f0e1a12d9c4f31a2f5
d4edec0e6d150110e180ad38f47e5eab79358d5df97f12e15c73a4b538863451
d5dc4157271c9d3147055b0f2b85578271417af24cb1cfd197b84194ddaa0bfa
d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af
d907a25c3d3f8d6999421726830d30d257ff947854d3770413e56b722eed8021
da508d57052981b6c0da5a43dfa9d1f121bc8d7617b0bef811d64f2c75084f39
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e568b5aabfa0debd7a5192f2248933aaf4642f240addd580871b0f198b59f564
e78bdb37a782cc88645fa74724d2f8acbb354c77f113863d3bb2abc713f01e48
e91d19121fbf6ef08ec7ce270a07ef60a36ee454268228a0d698f666c2d9f359
ebaeb8873c24b890cac4f7f1770a98da863e6b1a23f0d1c8d747dd75e7c2a975
ec464f6c5f7005d9ada96632adba09faea580a846b4e7ad18dbaa7bd7a64467a
ec5a240780ab83205367dfb9274a408269d2a10d837164fe39eebabd757d9e7e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb
eff032f2a7c04897a921492a9ce71e4fcbd047f1b2b487177955f000d6a182d6
f02faad1987312daa96dcd532794b6db4faa8a623306821b9d26235dbea36983
f21e3a5a80821feb91e7bb84d525742fd137c4b336f3ff3f1bb15dc2fcae9d70
f25f463d33decdb1f5541a41981dce02bc5998ba873bc466b79679f8e2ec9e42
f26ae51e214125767e456bc97f886b908749c984035ab7d7432fb11031a2a8e3
f2bee6f6d773e5a597a2b07e414b9abbaec0715598ecbfcea71540b5e463243b
f4cfd4a5b95dfb31c47cd567d9719fc12a0453f6ff27e2872147a9740e4b9e56
f53109bc9c1f5eba5a8e47a82b8a8e12de6fdd2c81f0a5320d5cd457708a5324
f797f871bec64d4d54308abab8c7008df6b855a83b59dbc17665e3c4111e7032
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.fortinet.com Open in urlscan Pro 2600:1f18:1492:1701:a964:c08d:f5eb:b0c Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

231 Requests

84 %HTTPS

37 %IPv6

62 Domains

92 Subdomains

73 IPs

2 Countries

6432 kBTransfer

9995 kBSize

125 Cookies

15 Outgoing links

Redirected requests

231 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1701:a964:c08d:f5eb:b0c Public Scan

Screenshot
Live screenshot

Full Image

231
Requests

84 %
HTTPS

37 %
IPv6

62
Domains

92
Subdomains

73
IPs

2
Countries

6432 kB
Transfer

9995 kB
Size

125
Cookies

231 HTTP transactions
2 data transactions