www.fortinet.com Open in urlscan Pro
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://401.tw/Mr6E
Effective URL:
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Submission: On September 20 via api (September 20th 2024, 1:15:14 pm UTC) from IN — Scanned from JP

Summary HTTP 238 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 73 IPs in 6 countries across 64 domains to perform 238 HTTP transactions. The main IP is 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06, located in Singapore, Singapore and belongs to AMAZON-02, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 115924.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 16th 2024. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.105.230.106 172.105.230.106	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
59	2406:da18:ad1... 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	2600:140b:a00... 2600:140b:a00:383::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	3.112.147.252 3.112.147.252	16509 (AMAZON-02) (AMAZON-02)
1	18.177.189.218 18.177.189.218	16509 (AMAZON-02) (AMAZON-02)
1 1	13.250.176.54 13.250.176.54	16509 (AMAZON-02) (AMAZON-02)
1	63.140.50.233 63.140.50.233	16509 (AMAZON-02) (AMAZON-02)
6	104.19.148.8 104.19.148.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	23.50.118.161 23.50.118.161	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.32.225.140 23.32.225.140	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.124.133.154 34.124.133.154	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2620:1ec:33::10 2620:1ec:33::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2404:6800:400... 2404:6800:4004:818::2008	15169 (GOOGLE) (GOOGLE)
2	38.133.127.191 38.133.127.191	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	2600:140b:1c0... 2600:140b:1c00:39::1732:7614	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	76.223.9.105 76.223.9.105	16509 (AMAZON-02) (AMAZON-02)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
6	142.251.42.136 142.251.42.136	15169 (GOOGLE) (GOOGLE)
1	63.140.50.191 63.140.50.191	16509 (AMAZON-02) (AMAZON-02)
4	43.201.174.92 43.201.174.92	16509 (AMAZON-02) (AMAZON-02)
4	2404:6800:400... 2404:6800:4004:825::2002	15169 (GOOGLE) (GOOGLE)
1 3	172.217.26.230 172.217.26.230	15169 (GOOGLE) (GOOGLE)
1 4	142.251.42.162 142.251.42.162	15169 (GOOGLE) (GOOGLE)
2	2404:6800:400... 2404:6800:4004:823::200e	15169 (GOOGLE) (GOOGLE)
2	2400:52e0:150... 2400:52e0:1501::1193:1	200325 (BUNNYCDN) (BUNNYCDN)
2	13.225.183.12 13.225.183.12	16509 (AMAZON-02) (AMAZON-02)
1 4	142.251.222.36 142.251.222.36	15169 (GOOGLE) (GOOGLE)
4	142.250.76.131 142.250.76.131	15169 (GOOGLE) (GOOGLE)
1	2606:4700:310... 2606:4700:3108::ac42:2af8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.32.164.86 52.32.164.86	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:bdf::46 2620:1ec:bdf::46	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	216.200.232.249 216.200.232.249	30419 (PAEDAE-INC) (PAEDAE-INC)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a04:4e42:200... 2a04:4e42:200::485	54113 (FASTLY) (FASTLY)
2	44.226.187.177 44.226.187.177	16509 (AMAZON-02) (AMAZON-02)
1	52.88.179.26 52.88.179.26	16509 (AMAZON-02) (AMAZON-02)
1	151.101.228.157 151.101.228.157	54113 (FASTLY) (FASTLY)
1 2	103.43.90.19 103.43.90.19	29990 (ASN-APPNEX) (ASN-APPNEX)
1 3	103.43.90.53 103.43.90.53	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:275... 2600:9000:2751:aa00:12:dfa9:e200:93a1	16509 (AMAZON-02) (AMAZON-02)
19 25	34.126.167.117 34.126.167.117	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	2600:9000:27a... 2600:9000:27af:c200:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
3 3	142.250.196.130 142.250.196.130	15169 (GOOGLE) (GOOGLE)
1	182.161.74.16 182.161.74.16	55569 (CRITEO-AS...) (CRITEO-AS-AP Criteo APAC)
2 3	74.118.186.107 74.118.186.107	6336 (TURN-US-ASN) (TURN-US-ASN)
1 2	35.71.178.8 35.71.178.8	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4200:439f:77e3:80bf:81be	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	57.180.73.140 57.180.73.140	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:26f... 2600:9000:26f2:6800:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	3.164.110.92 3.164.110.92	16509 (AMAZON-02) (AMAZON-02)
2 2	2600:1901:0:8... 2600:1901:0:8eee::	15169 (GOOGLE) (GOOGLE)
1 2	23.106.50.38 23.106.50.38	59253 (LEASEWEB-...) (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD.)
1 2	34.229.3.43 34.229.3.43	14618 (AMAZON-AES) (AMAZON-AES)
1	52.6.242.65 52.6.242.65	14618 (AMAZON-AES) (AMAZON-AES)
1	23.44.52.187 23.44.52.187	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 3	54.251.109.127 54.251.109.127	16509 (AMAZON-02) (AMAZON-02)
1 2	52.27.42.108 52.27.42.108	16509 (AMAZON-02) (AMAZON-02)
1 1	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	142.250.196.98 142.250.196.98	15169 (GOOGLE) (GOOGLE)
1	69.173.158.64 69.173.158.64	26667 (RUBICONPR...) (RUBICONPROJECT)
2	157.240.31.5 157.240.31.5	32934 (FACEBOOK) (FACEBOOK)
1	172.67.163.237 172.67.163.237	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	54.203.236.163 54.203.236.163	16509 (AMAZON-02) (AMAZON-02)
1 5	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:140b:1a0... 2600:140b:1a00:4::17c1:b89e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	35.160.46.251 35.160.46.251	16509 (AMAZON-02) (AMAZON-02)
1	54.183.57.53 54.183.57.53	16509 (AMAZON-02) (AMAZON-02)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f10... 2a03:2880:f10f:187:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3 3	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
2 3	18.182.162.20 18.182.162.20	16509 (AMAZON-02) (AMAZON-02)
2	52.89.99.220 52.89.99.220	16509 (AMAZON-02) (AMAZON-02)
1	35.81.162.201 35.81.162.201	16509 (AMAZON-02) (AMAZON-02)
1	52.10.121.135 52.10.121.135	16509 (AMAZON-02) (AMAZON-02)
238	73

1 172.105.230.106 (Tokyo, Japan) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1884-106.members.linode.com

401.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

59 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2600:140b:a00:383::1e80 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.112.147.252 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-112-147-252.ap-northeast-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.177.189.218 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-177-189-218.ap-northeast-1.compute.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.250.176.54 (Singapore, Singapore) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-250-176-54.ap-southeast-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.50.233 (United States)

ASN16509 (AMAZON-02, US)

fortinet.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.19.148.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 23.50.118.161 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-50-118-161.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.32.225.140 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-32-225-140.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wave.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.124.133.154 (Singapore, Singapore)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 154.133.124.34.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4004:818::2008 (Australia)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 38.133.127.191 (Sacramento, United States)

ASN22075 (AS-OUTBRAIN, US)

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:1c00:39::1732:7614 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.9.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.42.136 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s45-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.50.191 (United States)

ASN16509 (AMAZON-02, US)

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 43.201.174.92 (Incheon, Korea, Republic Of)

ASN16509 (AMAZON-02, US)
PTR: ec2-43-201-174-92.ap-northeast-2.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2404:6800:4004:825::2002 (Australia)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.26.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s51-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
10104846.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.42.162 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s46-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4004:823::200e (Australia)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:52e0:1501::1193:1 (Japan)

ASN200325 (BUNNYCDN, SI)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.183.12 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-183-12.nrt57.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.222.36 (Farmingdale, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt13s72-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.76.131 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: kix07s06-in-f3.1e100.net

www.google.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:2af8 (United States)

ASN13335 (CLOUDFLARENET, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1247 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.32.164.86 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-164-86.us-west-2.compute.amazonaws.com

abm-tracking.demandscience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:bdf::46 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

tmp.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixels.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
webtracker.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.200.232.249 (Frederick, United States)

ASN30419 (PAEDAE-INC, US)

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.226.187.177 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-226-187-177.us-west-2.compute.amazonaws.com

intentstream.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.88.179.26 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-88-179-26.us-west-2.compute.amazonaws.com

dx.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.228.157 (San Francisco, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.43.90.19 (Singapore, Singapore) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.43.90.53 (Singapore, Singapore) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 594.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2751:aa00:12:dfa9:e200:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.inzynk.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 34.126.167.117 (Singapore, Singapore) 19 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 117.167.126.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:27af:c200:1b:5138:8a40:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.196.130 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s36-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.161.74.16 (Singapore)

ASN55569 (CRITEO-AS-AP Criteo APAC, JP)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 74.118.186.107 (Serangoon New Town, Singapore) 2 redirects

ASN6336 (TURN-US-ASN, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.178.8 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ade9ecc7904667038.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4200:439f:77e3:80bf:81be (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 57.180.73.140 (Tokyo, Japan) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-57-180-73-140.ap-northeast-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26f2:6800:19:fc2c:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.164.110.92 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-3-164-110-92.nrt12.r.cloudfront.net

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.106.50.38 (Singapore, Singapore) 1 redirects

ASN59253 (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD., SG)

sync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.229.3.43 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-229-3-43.compute-1.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.6.242.65 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-242-65.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.44.52.187 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-44-52-187.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.251.109.127 (Singapore, Singapore) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-251-109-127.ap-southeast-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.27.42.108 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-27-42-108.us-west-2.compute.amazonaws.com

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.154.8 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.196.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s35-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.158.64 (Singapore, Singapore)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.31.5 (Tokyo, Japan)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-nrt1.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.163.237 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.203.236.163 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-236-163.us-west-2.compute.amazonaws.com

tracking.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.117.77.79 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:1a00:4::17c1:b89e (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.160.46.251 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-160-46-251.us-west-2.compute.amazonaws.com

35.160.46.251	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.183.57.53 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-183-57-53.us-west-1.compute.amazonaws.com

6033413.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f10f:187:face:b00c:0:25de (Tokyo, Japan)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.33.220.150 (Seattle, United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.182.162.20 (Tokyo, Japan) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-182-162-20.ap-northeast-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.89.99.220 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-89-99-220.us-west-2.compute.amazonaws.com

px.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.81.162.201 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-81-162-201.us-west-2.compute.amazonaws.com

gs.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.10.121.135 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-10-121-135.us-west-2.compute.amazonaws.com

px.steelhousemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	fortinet.com www.fortinet.com — Cisco Umbrella Rank: 115924 metrics.fortinet.com — Cisco Umbrella Rank: 284311	5 MB
27	simpli.fi 19 redirects tag.simpli.fi — Cisco Umbrella Rank: 4944 i.simpli.fi — Cisco Umbrella Rank: 4294 um.simpli.fi — Cisco Umbrella Rank: 934	15 KB
22	6sc.co j.6sc.co — Cisco Umbrella Rank: 5691 c.6sc.co — Cisco Umbrella Rank: 7155 ipv6.6sc.co — Cisco Umbrella Rank: 5832 b.6sc.co — Cisco Umbrella Rank: 3516 eps.6sc.co — Cisco Umbrella Rank: 825589 v.eps.6sc.co — Cisco Umbrella Rank: 905132	24 KB
22	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 452	151 KB
14	doubleclick.net 5 redirects td.doubleclick.net — Cisco Umbrella Rank: 189 ad.doubleclick.net — Cisco Umbrella Rank: 153 googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 cm.g.doubleclick.net — Cisco Umbrella Rank: 284 10104846.fls.doubleclick.net — Cisco Umbrella Rank: 296118	9 KB
10	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2506 tracking.crazyegg.com — Cisco Umbrella Rank: 4420	79 KB
8	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	726 KB
6	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	127 KB
5	ml314.com 1 redirects ml314.com — Cisco Umbrella Rank: 1751	14 KB
5	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 479 ib.adnxs.com — Cisco Umbrella Rank: 270	5 KB
5	outbrain.com amplify.outbrain.com — Cisco Umbrella Rank: 3422 tr.outbrain.com — Cisco Umbrella Rank: 3354 wave.outbrain.com — Cisco Umbrella Rank: 3410	10 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 327 px4.ads.linkedin.com — Cisco Umbrella Rank: 6795	2 KB
4	mountain.com dx.mountain.com — Cisco Umbrella Rank: 5047 px.mountain.com — Cisco Umbrella Rank: 5170 gs.mountain.com — Cisco Umbrella Rank: 9611	11 KB
4	google.co.jp www.google.co.jp — Cisco Umbrella Rank: 26138	256 B
4	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 3	216 B
4	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 256 fortinet.demdex.net — Cisco Umbrella Rank: 308668	2 KB
3	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1085	2 KB
3	adsrvr.org 3 redirects match.adsrvr.org — Cisco Umbrella Rank: 382	2 KB
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 932	822 B
3	t.co t.co — Cisco Umbrella Rank: 834	2 KB
3	crwdcntrl.net 2 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 989 sync.crwdcntrl.net — Cisco Umbrella Rank: 915	802 B
3	contanuity.com intentstream.contanuity.com — Cisco Umbrella Rank: 58667 tracking.contanuity.com — Cisco Umbrella Rank: 19503	1 KB
3	argusplatform.com tmp.argusplatform.com — Cisco Umbrella Rank: 299240 pixels.argusplatform.com — Cisco Umbrella Rank: 299605 webtracker.argusplatform.com — Cisco Umbrella Rank: 306518	4 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 28371 ibc-flow.techtarget.com — Cisco Umbrella Rank: 25060	2 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 361	15 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 106	4 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 178	71 KB
2	openx.net us-u.openx.net — Cisco Umbrella Rank: 526	400 B
2	lijit.com 1 redirects ce.lijit.com — Cisco Umbrella Rank: 943	897 B
2	exelator.com 1 redirects loadm.exelator.com — Cisco Umbrella Rank: 2052	3 KB
2	smartadserver.com 1 redirects sync.smartadserver.com — Cisco Umbrella Rank: 1446	1 KB
2	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2630	917 B
2	intentiq.com 1 redirects sync.intentiq.com — Cisco Umbrella Rank: 1035	2 KB
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 544 d.agkn.com — Cisco Umbrella Rank: 777	1 KB
2	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 467	1 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 424	971 B
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 509	730 B
2	smaato.net 2 redirects s.ad.smaato.net — Cisco Umbrella Rank: 676	1 KB
2	demandscience.com abm-tracking.demandscience.com — Cisco Umbrella Rank: 56454	3 KB
2	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 6393 api.omappapi.com — Cisco Umbrella Rank: 6510	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 8883	718 B
1	steelhousemedia.com px.steelhousemedia.com — Cisco Umbrella Rank: 12708	319 B
1	siteimproveanalytics.io 6033413.global.siteimproveanalytics.io — Cisco Umbrella Rank: 257361	149 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 782	14 KB
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3837	12 KB
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 414	1 KB
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 91	23 B
1	rlcdn.com 1 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 476	404 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 1278	445 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1589	421 B
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6782	175 B
1	unrulymedia.com sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1217	378 B
1	criteo.com dis.criteo.com — Cisco Umbrella Rank: 706	363 B
1	inzynk.io tags.inzynk.io — Cisco Umbrella Rank: 200853	441 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 875	15 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 314	15 KB
1	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 2662	712 B
1	opmnstr.com a.opmnstr.com — Cisco Umbrella Rank: 33929	18 KB
1	omtrdc.net fortinet.tt.omtrdc.net — Cisco Umbrella Rank: 295805	831 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1463	490 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 491	305 B
1	401.tw 1 redirects 401.tw	297 B
0	krxd.net Failed usermatch.krxd.net Failed
238	64

	Domain	Requested by
59	www.fortinet.com	www.fortinet.com
25	um.simpli.fi	19 redirects
22	assets.adobedtm.com	cdn.cookielaw.org assets.adobedtm.com
15	b.6sc.co	www.fortinet.com
8	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com abm-tracking.demandscience.com
6	script.crazyegg.com	www.fortinet.com script.crazyegg.com
6	cdn.cookielaw.org	www.fortinet.com cdn.cookielaw.org
5	ml314.com	1 redirects www.fortinet.com ml314.com
4	www.google.co.jp	www.fortinet.com
4	www.google.com	1 redirects www.fortinet.com
4	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
4	td.doubleclick.net	www.googletagmanager.com
4	tracking.crazyegg.com	script.crazyegg.com
3	ps.eyeota.net	2 redirects
3	match.adsrvr.org	3 redirects
3	px.ads.linkedin.com	1 redirects snap.licdn.com
3	analytics.twitter.com
3	t.co
3	cm.g.doubleclick.net	3 redirects
3	ib.adnxs.com	1 redirects
3	bat.bing.com	assets.adobedtm.com bat.bing.com www.fortinet.com
3	dpm.demdex.net	www.fortinet.com
2	px.mountain.com	dx.mountain.com px.mountain.com
2	www.facebook.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	10104846.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	us-u.openx.net
2	ce.lijit.com	1 redirects
2	bcp.crwdcntrl.net	1 redirects
2	loadm.exelator.com	1 redirects
2	sync.smartadserver.com	1 redirects
2	fei.pro-market.net	2 redirects
2	sync.intentiq.com	1 redirects
2	pixel.tapad.com	1 redirects
2	eb2.3lift.com	1 redirects
2	sync.1rx.io	2 redirects
2	s.ad.smaato.net	2 redirects
2	secure.adnxs.com	1 redirects
2	intentstream.contanuity.com	abm-tracking.demandscience.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	abm-tracking.demandscience.com	www.fortinet.com abm-tracking.demandscience.com
2	v.eps.6sc.co	j.6sc.co
2	www.google-analytics.com	www.googletagmanager.com
2	eps.6sc.co	j.6sc.co
2	epsilon.6sense.com	j.6sc.co
2	tr.outbrain.com	amplify.outbrain.com
2	amplify.outbrain.com	www.fortinet.com amplify.outbrain.com
1	px.steelhousemedia.com
1	gs.mountain.com	px.mountain.com
1	sync.crwdcntrl.net	1 redirects
1	px4.ads.linkedin.com
1	6033413.global.siteimproveanalytics.io
1	snap.licdn.com	www.fortinet.com
1	webtracker.argusplatform.com	tmp.argusplatform.com
1	tracking.contanuity.com	abm-tracking.demandscience.com
1	siteimproveanalytics.com	assets.adobedtm.com
1	pixel.rubiconproject.com
1	www.googleadservices.com	1 redirects
1	idsync.rlcdn.com	1 redirects
1	stags.bluekai.com
1	sync.bfmio.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.targeting.unrulymedia.com
1	dis.criteo.com
1	tags.inzynk.io	assets.adobedtm.com
1	static.ads-twitter.com	www.fortinet.com
1	dx.mountain.com	www.fortinet.com
1	i.simpli.fi	tag.simpli.fi
1	cdn.jsdelivr.net	abm-tracking.demandscience.com
1	pixels.argusplatform.com	tmp.argusplatform.com
1	pixel.mathtag.com	www.fortinet.com
1	tmp.argusplatform.com	www.fortinet.com
1	trk.techtarget.com	www.fortinet.com
1	api.omappapi.com	a.opmnstr.com
1	a.omappapi.com	a.opmnstr.com
1	a.opmnstr.com	assets.adobedtm.com
1	ad.doubleclick.net	www.fortinet.com
1	metrics.fortinet.com	www.fortinet.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	wave.outbrain.com	amplify.outbrain.com
1	tag.simpli.fi	assets.adobedtm.com
1	j.6sc.co	www.fortinet.com
1	fortinet.tt.omtrdc.net	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	www.fortinet.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	401.tw	1 redirects
0	usermatch.krxd.net Failed
238	91

This site contains links to these domains. Also see Links.

Domain
github.com
nvd.nist.gov
geoserver.org
www.cisa.gov
www.fortiguard.com
attack.mitre.org
training.fortinet.com
www.linkedin.com
www.twitter.com
www.youtube.com
www.instagram.com
www.facebook.com
fortiguard.com
community.fortinet.com
investor.fortinet.com
onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-16` - `2025-07-15`	a year	crt.sh
cookielaw.org WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
script.crazyegg.com Cloudflare Inc ECC CA-3	`2024-08-02` - `2024-12-31`	5 months	crt.sh
6sc.co R11	`2024-07-03` - `2024-10-01`	3 months	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-14` - `2024-12-14`	a year	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-04-04` - `2025-05-04`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-30` - `2025-09-29`	a year	crt.sh
metrics.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-26` - `2025-01-25`	a year	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-06-21` - `2025-07-20`	a year	crt.sh
*.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
a.opmnstr.com R10	`2024-08-08` - `2024-11-06`	3 months	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
*.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.google.co.jp WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
a.omappapi.com R10	`2024-08-08` - `2024-11-06`	3 months	crt.sh
omappapi.com WE1	`2024-08-14` - `2024-11-12`	3 months	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
abm-tracking.demandscience.com R10	`2024-08-14` - `2024-11-12`	3 months	crt.sh
tmp.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
*.mathtag.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-04-23` - `2025-04-30`	a year	crt.sh
ibc-flow.techtarget.com WR3	`2024-08-28` - `2024-11-26`	3 months	crt.sh
pixels.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-08` - `2025-03-08`	6 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
intentstream.contanuity.com E6	`2024-08-15` - `2024-11-13`	3 months	crt.sh
*.mountain.com Go Daddy Secure Certificate Authority - G2	`2024-05-23` - `2025-06-24`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
*.inzynk.io Amazon RSA 2048 M02	`2024-01-07` - `2025-02-04`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-29` - `2024-09-27`	3 months	crt.sh
siteimproveanalytics.com WE1	`2024-08-19` - `2024-11-17`	3 months	crt.sh
t.co E6	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-02` - `2024-10-31`	a year	crt.sh
tracking.contanuity.com R11	`2024-09-11` - `2024-12-10`	3 months	crt.sh
webtracker.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-08-21` - `2024-11-19`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
35.160.46.251 Sectigo RSA Domain Validation Secure Server CA	`2024-09-11` - `2025-09-22`	a year	crt.sh
*.global.r1.siteimproveanalytics.io Amazon RSA 2048 M03	`2024-09-02` - `2025-10-01`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-09-11` - `2025-03-11`	6 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Frame ID: D5E2BB638E3DDCD98386EAC9FF3AF350
Requests: 227 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: CC8553C6A2E0E9C8991D46E76A1B166B
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=1538869018.1726838104;ps=1;pcor=323568843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Frame ID: 9CC6B9A826A0A184AC24DEE62E579219
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/729495989?random=1726838106592&cv=11&fst=1726838106592&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 87E979BC58C841331A4EDA5B5672E644
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/609297413?random=1726838106678&cv=11&fst=1726838106678&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: FAA25794258044F0803450053E69204A
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/662878185?random=1726838106770&cv=11&fst=1726838106770&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 19B3DAA15A2A20F9ADB6A8B3CF397DBD
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=CJXZuqDN0YgDFdhvDwId03w2zQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4963256837942.36
Frame ID: 9BF7E053673F9D71E895908C4A954428
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401 | FortiGuard Labs

Page URL History Show full URLs

https://401.tw/Mr6E HTTP 307
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-... Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

FingerprintJS (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/fingerprintjs@(\d)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

238
Requests

87 %
HTTPS

27 %
IPv6

64
Domains

91
Subdomains

73
IPs

6
Countries

6826 kB
Transfer

10691 kB
Size

111
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/geoserver/geoserver
Title: open-source software

Search URL Search Domain Scan URL

URL: https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
Title: advisory

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36401
Title: CVE-2024-36401

Search URL Search Domain Scan URL

URL: https://geoserver.org/announcements/vulnerability/2024/06/18/geoserver-2-25-2-released.html
Title: addressed

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/alerts/2024/07/15/cisa-adds-one-known-exploited-vulnerability-catalog
Title: added

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/encyclopedia/ips/56197
Title: IPS signature

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/groups/G0096/
Title: APT41

Search URL Search Domain Scan URL

URL: https://github.com/fatedier/frp
Title: Fast Reverse Proxy

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/groups/G0059/
Title: Magic Hound

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
Title: Fox Kitten

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
Title: Volt Typhoon

Search URL Search Domain Scan URL

URL: https://training.fortinet.com/local/staticpage/view.php?page=fcf_cybersecurity
Title: Fortinet Certified Fundamentals (FCF) in Cybersecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fortinet/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://community.fortinet.com/
Title: Fortinet Community

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://401.tw/Mr6E HTTP 307
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 68

https://cm.everesttech.net/cm/dd?d_uuid=30541821646655490073624486381940051027 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11VQAAAFSjTgOn

Request Chain 174

https://secure.adnxs.com/px?id=1773420&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Request Chain 175

https://ib.adnxs.com/seg?add=36113683 HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Request Chain 177

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=EFB6A5247DFA4216AC575DEF6DB3FD1E HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smaato&gdpr=0&gdpr_consent=&google_hm=4629f255ae&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://s.ad.smaato.net/c/?adExInit=g&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP 302
https://dis.criteo.com/dis/usersync.aspx?r=80&p=286&cp=smaato&cu=1&url=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FdspId%3D1001851%26dspCookie%3D%24%7BCRITEO_USERID%7D%26gdpr%3D0%26gdpr_consent%3D,&gdpr=0&gdpr_consent=,

Request Chain 178

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/EFB6A5247DFA4216AC575DEF6DB3FD1E HTTP 302
https://sync.1rx.io/usersync/simplifi/EFB6A5247DFA4216AC575DEF6DB3FD1E?zcc=1&cb=1726838108984 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-e92ccebb-ff6a-487f-acbc-40f90504edf9-004

Request Chain 179

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=EFB6A5247DFA4216AC575DEF6DB3FD1E&dongle=yf3 HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=EFB6A5247DFA4216AC575DEF6DB3FD1E&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

Request Chain 180

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=EFB6A5247DFA4216AC575DEF6DB3FD1E

Request Chain 181

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=EFB6A5247DFA4216AC575DEF6DB3FD1E HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=EFB6A5247DFA4216AC575DEF6DB3FD1E

Request Chain 182

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=EFB6A5247DFA4216AC575DEF6DB3FD1E HTTP 302
https://d.agkn.com/pixel/10751/?che=1726838108896&ip=146.70.201.218&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D232283305011003802890 HTTP 302
https://um.simpli.fi/aa_px?sk=232283305011003802890 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 183

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EFB6A5247DFA4216AC575DEF6DB3FD1E HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EFB6A5247DFA4216AC575DEF6DB3FD1E&ckls=true&ci=K0frtNyOzI&nc=false&trid=664204504

Request Chain 186

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=EFB6A5247DFA4216AC575DEF6DB3FD1E;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=EFB6A5247DFA4216AC575DEF6DB3FD1E;mimetype=img;sr HTTP 302
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Ffei.pro-market.net%2Fengine%3Fsite%3D161185%26size%3D1x1%26du%3D36%26csync%3D[sas_uid] HTTP 302
https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1

Request Chain 187

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=EFB6A5247DFA4216AC575DEF6DB3FD1E&j=0 HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=EFB6A5247DFA4216AC575DEF6DB3FD1E&j=0&xl8blockcheck=1

Request Chain 189

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=EFB6A5247DFA4216AC575DEF6DB3FD1E

Request Chain 190

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=EFB6A5247DFA4216AC575DEF6DB3FD1E

Request Chain 191

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=EFB6A5247DFA4216AC575DEF6DB3FD1E HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=EFB6A5247DFA4216AC575DEF6DB3FD1E

Request Chain 192

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=EFB6A5247DFA4216AC575DEF6DB3FD1E HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=EFB6A5247DFA4216AC575DEF6DB3FD1E&dnr=1

Request Chain 193

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=EFB6A5247DFA4216AC575DEF6DB3FD1E HTTP 307
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D

Request Chain 194

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1726838108360&cv=7&fst=1726838108360&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1495905364&cv=7&fst=1726838108360&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7EC&pscrd=IhMIxMK_oM3RiAMV1ojpBR084iYpMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=1495905364&cv=7&fst=1726838108360&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7EC&pscrd=IhMIxMK_oM3RiAMV1ojpBR084iYpMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfDRZGiVCUVyDi4r8XMfhdXVB0YfcSJCUC3hVYMPGEL1CZkbr5&random=1393785885 HTTP 302
https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=1495905364&cv=7&fst=1726838108360&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7EC&pscrd=IhMIxMK_oM3RiAMV1ojpBR084iYpMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfDRZGiVCUVyDi4r8XMfhdXVB0YfcSJCUC3hVYMPGEL1CZkbr5&random=1393785885&ipr=y

Request Chain 196

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=EFB6A5247DFA4216AC575DEF6DB3FD1E

Request Chain 197

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=EFB6A5247DFA4216AC575DEF6DB3FD1E&expires=365

Request Chain 198

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=EFB6A5247DFA4216AC575DEF6DB3FD1E

Request Chain 199

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_gid=CAESEM_D5pw2sYTAA1M15IIXuvM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=EFB6A5247DFA4216AC575DEF6DB3FD1E HTTP 302
https://um.simpli.fi/g_match?id=

Request Chain 201

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4963256837942.36 HTTP 302
https://10104846.fls.doubleclick.net/activityi;dc_pre=CJXZuqDN0YgDFdhvDwId03w2zQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4963256837942.36

Request Chain 220

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838109562&li_adsId=7bf4f8b1-e549-4e8f-8afa-55245d244317&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838109562&li_adsId=7bf4f8b1-e549-4e8f-8afa-55245d244317&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&e_ipv6=AQLjWjGDw7OURwAAAZIPknX-F0Ya2srLwnP-SCY0FeBw5FEWSc3Crlr5Fvt8l4FzXJ8Jaw

Request Chain 225

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&gdpr=0&gdpr_consent=

Request Chain 226

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3647144415818416199 HTTP 302
https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144415818416199

Request Chain 227

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2r5Ut5E2THlV76arILluoSGyuI94VbXoaMOJixj48dEg&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

Request Chain 228

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838108540 HTTP 303
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838108540&_bee_ppp=1 HTTP 303
https://tracking.contanuity.com/usersync?bwcookie=AAF-wU7N2usAABTSuUdfPQ

Request Chain 235

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=5d1c16bc-7752-11ef-a262-b14d38c6f294&gdpr=&gdpr_consent= HTTP 302
https://px.steelhousemedia.com/tdsync?tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&shguid=5d1c16bc-7752-11ef-a262-b14d38c6f294

Request Chain 236

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://tags.bluekai.com/site/5386?id=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NDU1NjQ4ZTAtMzA1Yi00ZDljLWE0OWYtYmNkMmZlMzliMmI2&gdpr=0&gdpr_consent=&ttd_tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6 HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&google_gid=CAESEJmdV3Vq4puV0O3AKTck2ek&google_cver=1 HTTP 302
https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6

238 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request threat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Show response
www.fortinet.com/blog/threat-research/
Redirect Chain

https://401.tw/Mr6E
https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

103 KB
29 KB

218ms
75ms

Document
text/html

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

3d6bc3dbcf9e2cf02f556ae8bd0936e8b62540189823df29c4f524c060bb8328

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=600, public, s-maxage=10800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 27960
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Type: text/html;charset=utf-8
Date: Fri, 20 Sep 2024 13:14:57 GMT
ETag: "19b93-622789a9c9e4b-gzip"
Last-Modified: Thu, 19 Sep 2024 13:07:25 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
X-Amz-Cf-Id: azoYQ5lkaKF0VSDf6ur8IDF9YNLRM0UEge_3-LXAnlZi9Dz0vEShYw==
X-Amz-Cf-Pop: SIN2-P4
X-Cache: Hit from cloudfront
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1-28559771
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 142
Content-Type: text/html; charset=utf-8
Date: Fri, 20 Sep 2024 13:14:57 GMT
Location: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Server: nginx/1.26.1

GET
H/1.1 200
OK visitorapi.min.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 64 KB
30 KB 212ms
75ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "fe2d-6117284c96900-gzip"
Age: 330502
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: mPjlvvtd4R1VuZwdx4p1NvglFFj5bbli1GvlpuqHwLszXYDqeqxicw==
Date: Mon, 16 Sep 2024 17:27:27 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 15 Feb 2024 21:43:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29532
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK at.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 104 KB
48 KB 216ms
76ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "19e83-61431fc4b24c0-gzip"
Age: 330463
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 7I4gIwcgn9GVdjEsEShPrnlxqqkoPIEbt42Z6cTx4JRWqFLn3d6q-g==
Date: Mon, 16 Sep 2024 17:27:28 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 21 Mar 2024 20:59:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 01348adbf285860dd21bc52b989abbe4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47782
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 540 KB
28 KB 975ms
922ms Stylesheet
text/css 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "86e1b-61b58998583c0-gzip"
Age: 5163976
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: Pu0P0UoujYnYm6j3DEWo2N-gIvPW19PFKdPPiUnwuIJouG9G8DF8eg==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: text/css;charset=utf-8
Last-Modified: Thu, 20 Jun 2024 21:00:07 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27478
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 54ms
36ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: jwlUUXc1HMPClYXMpY+NPQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCD8180F629235
x-ms-lease-status: unlocked
age: 62199
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 19:58:18 GMT
date: Fri, 20 Sep 2024 13:14:57 GMT
content-type: application/javascript
last-modified: Wed, 18 Sep 2024 19:28:22 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-ms-request-id: 6758b5e5-201e-0098-0fc4-0a1db5000000
cf-ray: 8c6214de8d8be354-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6881
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 390ms
249ms Image
image/svg+xml 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 34042416
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: A2vN0YnEhQ4dbUydsx1qVu2mW0hssW0r_fhRziJgpEFkCUdEmqYHkg==
Date: Fri, 20 Sep 2024 13:14:57 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 903d095eb644af4425e3808326bdc4e8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
3 KB 729ms
588ms Image
image/jpeg 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "4fd-60a2031eb4f40"
Age: 26854834
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: pxp7xtD14ZS_tZl2mbBUzaisq0EyVlLkcWaHQM4FWegTFkxSancWnQ==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 8f23eaccc3b115094ce6ce3910c583e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 160 KB
74 KB 1099ms
1099ms Script
application/javascript 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "28100-61cff12ce1d80-gzip"
Age: 5163975
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: fZkTV_6XBVwG9itcaXi1kEvADVFx3S0B7sPt--kNvw3NVHTgkwxroQ==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: application/javascript;charset=utf-8
Vary: Accept-Encoding
Last-Modified: Thu, 11 Jul 2024 21:01:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 903d095eb644af4425e3808326bdc4e8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 74768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 5 KB
2 KB 51ms
37ms XHR
application/x-javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Uj3iBUKm1Vl2g2NHq67V+w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF23DF5130
age: 74502
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 21 Sep 2024 13:14:58 GMT
date: Fri, 20 Sep 2024 13:14:58 GMT
content-type: application/x-javascript
last-modified: Thu, 28 Dec 2023 19:56:54 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-ms-request-id: c21183be-301e-00a5-5054-cda893000000
cf-ray: 8c6214e51d668095-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1792
x-ms-blob-type: BlockBlob
server: cloudflare

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK geoserver-hero.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 370 KB
372 KB 73ms
72ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/geoserver-hero.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

83201017e411b72434080a221b102049e9074e205d97f65219d2286abd683012

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "5c8ee-621505f67c380"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: mbEWZyJfnaua8kJe3EJjZ5KC2MZ2vkPYQV6nFYEL17BErSDUuK6yYg==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 19:42:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 379118
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK chavecloak-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 37 KB
38 KB 75ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/chavecloak-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

fd9f918bd5a22813d48748b8c79e2acaeeb590d217575e0d79d734cba9de7736

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "9490-611dcced7f240"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: SipfaKfSh7rCcqR31pCY6yGqvK8zeEKkK7bfl_4te7qPreU30sXmmw==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/png
Last-Modified: Wed, 21 Feb 2024 04:32:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 8f23eaccc3b115094ce6ce3910c583e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 38032
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK scrubcrypt-24-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 43 KB
44 KB 75ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/scrubcrypt-24-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

2eceae481c2cda87ecdc8e65c8bbd62ddc9538144c42ff6c1cd720cd5781623c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "ab05-6155cc8f5f240"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: gT6gT1fFE41Lbe9HbDMRHwUXRbVFQGEqJCvEGetqAPfwZQYQ3IEaDw==
Date: Fri, 20 Sep 2024 13:14:58 GMT
Content-Type: image/png
Last-Modified: Fri, 05 Apr 2024 17:28:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 01348adbf285860dd21bc52b989abbe4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 43781
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK lumma-variant-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 46 KB
48 KB 919ms
918ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/lumma-variant-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

11c69167edad4aa2ac0c3def81f10e2caf7375ca37d9170e9277ac2cef39eb32

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "b8c6-60dff3ae26100"
Age: 22103894
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: FHk8n8TsQv_sB0cIM94gbKJQrJSv8OaFawidzNw8-xIlJ3nU0rGzSg==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Tue, 02 Jan 2024 23:55:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47302
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
38 KB 74ms
74ms Font
application/octet-stream 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Response headers

X-Vhost: publish
ETag: "9354-5df4fa74ff980"
Age: 330539
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: F5DmmxqNpy1kEAe0tOVOqVjT2uxG9MZxrrhS_9YNw1AEx8utvX__MA==
Date: Mon, 16 Sep 2024 17:27:32 GMT
Content-Type: application/octet-stream
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37716
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
305 B 63ms
42ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

291ac3898f3f28bd32810a5ef0f380363afee480e535632f0254da751f775c63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8c6214ea3f82afbd-NRT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:14:59 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H/1.1 200
OK fig01-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1725493359930/ 61 KB
62 KB 74ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1725493359930/fig01-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6bb4e76fdeac3f86fe514013ea4ec43b69cf824a9cb00b4d90ca33eb27df3712

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "f3de-62153bab9b9c0"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: u3uFj2mLpE5MqLrbtQuyL2Cv95dzkgJVPz2zcjZFQBSR8wg0IMleIQ==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 62430
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.10.0/ 356 KB
78 KB 22ms
22ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Bh9exWOPGIwRshWljrtlEw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735260901BC
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 50961
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:14:59 GMT
content-type: application/javascript
last-modified: Thu, 03 Dec 2020 02:43:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 196e3d49-701e-0078-0644-149a7b000000
cf-ray: 8c6214ec4b9ee354-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 79698
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fig02-geoserver-script-file-remote-sh.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_542065486.img.png/1725493737369/ 449 KB
451 KB 940ms
925ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_542065486.img.png/1725493737369/fig02-geoserver-script-file-remote-sh.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9cbf9589d98422a08f788b3863a74d1a27c3d92289f8829620c4d8925b967b94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "70532-62153d1418c40"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: L0Za1A65JNoyHaDG7USqcj2iRf2h4nO_4u-wrxmLuoSuint0fB153A==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:48:57 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 460082
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig03-geoserver-gorevese.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_992669665.img.png/1725493760506/ 50 KB
51 KB 101ms
80ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_992669665.img.png/1725493760506/fig03-geoserver-gorevese.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

38cfaeb6a3cb2cff2b9b11f9945838fd640ac7c0483e093239a29400c7d2ee66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "c6c1-62153d2a08000"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: mkq6FvSVKi4cxxMq3SrUTMJU6THA1CL74g7sBOzFUsUog2KwKujoRQ==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:49:20 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 50881
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig04-geoserver-goreverse-log.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_744399015.img.png/1725493351601/ 265 KB
267 KB 100ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_744399015.img.png/1725493351601/fig04-geoserver-goreverse-log.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

07405b002bac345765f6de032ed07cac28e77745e73850bf4aed8f891822c37a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "42511-62153ba3fa7c0"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: nMwSKu66HdR651VKHvS6uIKIokzGkGGN1VapKnJSi8-kpz-wUJNRVw==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 903d095eb644af4425e3808326bdc4e8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 271633
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig05-geoserver-goreverse-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_963623453.img.png/1725493337854/ 75 KB
76 KB 961ms
934ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_963623453.img.png/1725493337854/fig05-geoserver-goreverse-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

4713f4e99bebe488012bb9f5ccbaa25d83f2ecec4dbfc2c71f81ad33df9d1c10

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "12a2b-62153b96a0840"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: 8Mz_0Cf4sjhxH42ZSE6BYd1asxYXjtT4X3p96gy1JaWGovmp5lUIXA==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 01348adbf285860dd21bc52b989abbe4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 76331
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig06-geoserver-script-file-d.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1712359983.img.png/1725493331271/ 185 KB
187 KB 118ms
91ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1712359983.img.png/1725493331271/fig06-geoserver-script-file-d.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f188b1683849ebab2c42aa623674d573d89c3a8b8a533f4e2ec35fe7a9e8000e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "2e589-62153b90e7ac0"
Age: 1283665
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: k-bWCejwJmSOqvqxFDaheHtgOjXAo-QBCI3tqSIEYCLojE9KAqAt2A==
Date: Fri, 20 Sep 2024 13:14:59 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:42:11 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 8f23eaccc3b115094ce6ce3910c583e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 189833
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig07-geoserver-creating-folders.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_219608780.img.png/1725493380912/ 113 KB
115 KB 289ms
258ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_219608780.img.png/1725493380912/fig07-geoserver-creating-folders.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

706300e054788f930de76af585fc6511091289d01c65c440964ca6abb898e7dc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1c505-62153bbfa2900"
Age: 1283665
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: _SKeBXSkvFAloZzXuxNZK4_mFt9StTGZElr7TUWficKzSZzC0QHGSA==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c3691d761a167bc90e6d3311843f48ce.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 115973
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig08-geoserver-xor-decoded-0x60.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_359750668.img.png/1725509365855/ 115 KB
117 KB 311ms
306ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_359750668.img.png/1725509365855/fig08-geoserver-xor-decoded-0x60.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

c6c7eafdd4ce7cbca90175e42e4d11a9ebcfaed70b6471572a0d3d0ae7dde57f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1cd07-6215774c1e740"
Age: 1284545
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: RkpWDQ7FVKgMRVbw1xxCrBo6XKbEIVah9j2PZ3uQSbPnqoN3pN8FqA==
Date: Fri, 20 Sep 2024 13:15:00 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:09:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 118023
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig09-geoserver-saved-decoded-files.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1078076399.img.png/1725493420288/ 33 KB
35 KB 97ms
94ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1078076399.img.png/1725493420288/fig09-geoserver-saved-decoded-files.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b133508601dd82610cda75ed20bc034dd90b459dcd74b8b44e75998e38d19477

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "85a6-62153be5c8300"
Age: 15157
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: -YTRCjflRIgYXTG4AkgWOFeCFliUE15VHBYmGm1-dNbOf7o5hOYj0g==
Date: Fri, 20 Sep 2024 09:02:23 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:40 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c3691d761a167bc90e6d3311843f48ce.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 34214
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig10-geoserver-xor-decoded-0x89.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1956682136.img.png/1725493436943/ 131 KB
133 KB 282ms
267ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1956682136.img.png/1725493436943/fig10-geoserver-xor-decoded-0x89.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5b7b4be8ed582776a1ad52eed0fe06afe968c34e31d566c473feb92ac6a270e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "20cd5-62153bf50a700"
Age: 1283666
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: aR4_qNA9eg-_p62F5oxpsGncHMwchYyULve5S8GfTF1EApRuIQbGqA==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:43:56 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 134357
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig11-geoserver-decrypted-configuration-chacha20.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1654479811.img.png/1725493462325/ 41 KB
42 KB 101ms
99ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1654479811.img.png/1725493462325/fig11-geoserver-decrypted-configuration-chacha20.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

44fc655655fedce3141e358eabb02c39e838d48e6643b1c58c395adfc23757d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "a2f9-62153c0dd6180"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: K75scohAfuLweUt8WddwmtlOBKG3HwBDz9et5Ns_I6e4tC5sMCciOA==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:44:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 8f23eaccc3b115094ce6ce3910c583e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 41721
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig12-geoserver-encrypted-binary.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_881935709.img.png/1725493495125/ 160 KB
161 KB 88ms
87ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_881935709.img.png/1725493495125/fig12-geoserver-encrypted-binary.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2ac7d5402f2266e77a525cf70164ad40fb86b0981530cad5af3e3610a209768

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "27ee7-62153c2d4ebc0"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: xIUwJJ0FOy8PSFsCnKxASAmFnowckpzMIUjaVWTHFsVAu3Nfw8-tEQ==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:44:55 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 c3691d761a167bc90e6d3311843f48ce.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 163559
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig13-geoserver-decrypted-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2093410339.img.png/1725493500451/ 121 KB
122 KB 750ms
748ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2093410339.img.png/1725493500451/fig13-geoserver-decrypted-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e8f00eb416ad5af6f4524e1b7efd086a2244bf48757eee0fbdf583c20afa1dad

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1e310-62153c3213700"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: nufgwhJCFMNZs8w9tVWYukF5c3ron3eQUM0s2rNCk8gU2_JXWrcyHw==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 8f23eaccc3b115094ce6ce3910c583e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 123664
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig14-geoserver-packet-capture-c2-connection.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1728308731.img.png/1725493517259/ 138 KB
140 KB 624ms
623ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1728308731.img.png/1725493517259/fig14-geoserver-packet-capture-c2-connection.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9ae293c59bba08f1a56f697a11015ee4b251b0f38c309f83c80d7f6e7369caa4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "229ef-62153c4249d40"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: -LFiY_xwbeU1qTah8_0tbuS3u15l_RB6pZXFC7dSn5Rnu3DikCSSdw==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 01348adbf285860dd21bc52b989abbe4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 141807
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig15-geoserver-c2-communication.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1929634219.img.png/1725493533356/ 71 KB
73 KB 621ms
619ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1929634219.img.png/1725493533356/fig15-geoserver-c2-communication.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

89905a0e0efe1119d95b1e69de27157b35b8043115708fa06eb74dc706568a7b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "11cc6-62153c518c140"
Age: 1284614
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: 3jCFm3r0f8aq2SkEJXGcrWIiNB_GKmaAM0ZaZuWAs-HvGaKxzFwKhw==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:45:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 903d095eb644af4425e3808326bdc4e8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 72902
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig16-geoserver-fpr-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1939040249.img.png/1725509412346/ 129 KB
130 KB 77ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1939040249.img.png/1725509412346/fig16-geoserver-fpr-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

fd688f7a638dad7a8d7c394f5443ed8ccb3158d4555937c1e0f51546b2fc9612

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "20403-62157778f1100"
Age: 1284617
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: NbutyOLc_0moyg_t8vRu4T8djwsVs73iBNVpZgnyKvF5elli8me-zw==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:10:12 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 903d095eb644af4425e3808326bdc4e8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 132099
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig17-geoserver-packet-capture-fpr.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_763250428.img.png/1725509429420/ 106 KB
108 KB 88ms
83ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_763250428.img.png/1725509429420/fig17-geoserver-packet-capture-fpr.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

609ca44aa6a92944559e4d17e84e29651b391c6c3438184474fd67e602250e7d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1a98f-6215778927740"
Age: 1284617
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: lfAg6KIlpfrikYqGhfAvwQ-rZ44A90ZtcQF-AJwU48OzZhadnMcYHQ==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:10:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 108943
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig18-geoserver-telemetry.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_44410991.img.png/1725493592407/ 93 KB
94 KB 89ms
72ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_44410991.img.png/1725493592407/fig18-geoserver-telemetry.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8d121b33124fce841c6927c1214d2aa4fe7e5c52629de45f68f325f749a5857d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1725d-62153c89d0600"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: kJlWRd-QtkU3m4MZTb5dy8bUOpICCIb0kCLoh_hWPnVH3FLC5SnMzQ==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:46:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 01348adbf285860dd21bc52b989abbe4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 94813
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig19-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1852080368.img.png/1725493624336/ 117 KB
119 KB 82ms
76ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1852080368.img.png/1725493624336/fig19-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ae7d18a41edd5f27e717f872a1113addddbf1553e00b3db1baefa99b68fda302

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1d5d5-62153ca854e00"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: eNI6PW6JqfVbFTEuWNPrdInm6ximCE3LEpmc6COgWw8PNsiFo4gusQ==
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:47:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 c3691d761a167bc90e6d3311843f48ce.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 120277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig20-geoserver-xor-decoded-function.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_898199783.img.png/1725493640566/ 30 KB
32 KB 76ms
71ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_898199783.img.png/1725493640566/fig20-geoserver-xor-decoded-function.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

a4b0a228372854369707f452fb9124e5bc34319c8c3323b5379111ac9ba4bac6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "794f-62153cb797200"
Age: 24794
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: mXbVDh2P_5S4SBjM_wmRWa-r_3sIW1sMP70EQowNrVnHyN89vrg45Q==
Date: Fri, 20 Sep 2024 06:21:47 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:47:20 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 8f23eaccc3b115094ce6ce3910c583e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31055
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig21-geoserver-decoded-config-data.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_88540031.img.png/1725493799908/ 18 KB
19 KB 77ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_88540031.img.png/1725493799908/fig21-geoserver-decoded-config-data.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f2771985061ab617dd696611136d31d58dba565372eaf86c562d59d8bae3fd9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "4702-62153d4f397c0"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: kcqlA4o995a00Sk389o_KZoLxU3xS6_yuK2sTPg1vb8_LhyuJV-NeQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:49:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 903d095eb644af4425e3808326bdc4e8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 18178
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig22-geoserver-execution-msg.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2095532140.img.png/1725493821159/ 26 KB
28 KB 76ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_2095532140.img.png/1725493821159/fig22-geoserver-execution-msg.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

351ba146db40e108b8dcbf0f9cc288d6cc19615020b2aeb1c0f508b79e78b93e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "69e7-62153d6434940"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: GaIhwzZs_algiI1HSxKQKVEZuww_gfazSzkycnq0axEl_XOURxtnXw==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:50:21 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27111
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig23-geoserver-hard-coded-payload.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1513040984.img.png/1725493835492/ 117 KB
119 KB 78ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1513040984.img.png/1725493835492/fig23-geoserver-hard-coded-payload.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5f83323b31dd79cc7f9104b638a2706b0e12b6e521f48d21ba638b67279f4417

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1d57e-62153d718e8c0"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: h0yHUwUgmVOpD6x-hmOgrv2p0pIhBGYnV4Dlw1YdRqNhCmLwLJskWQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:50:35 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 01348adbf285860dd21bc52b989abbe4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 120190
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig24-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_982915008.img.png/1725493868694/ 154 KB
155 KB 87ms
82ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_982915008.img.png/1725493868694/fig24-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8b195a98b1a9fa227dd6712c4af7ccbd807baa4a4b21491d97dbc09c1e13798a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "26815-62153d9107300"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: SypU7PSRyoVKfb4heFaTY7EuVC7csgnKZPbrY4PHbMPduoFFzFmrAQ==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:51:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 157717
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig25-geoserver-significant-string.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_903278817.img.png/1725493885710/ 27 KB
28 KB 76ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_903278817.img.png/1725493885710/fig25-geoserver-significant-string.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

2cc20824e35c6be438211ca8dcf0baa6b8e6df5473454d953a0c96d10eedae7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6a84-62153da13d940"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: HXtq9fgiupwnDlWeEsbn54zPFWLma1aD4MIGiFypaaf4iKJxd6c_Yw==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:51:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 8f23eaccc3b115094ce6ce3910c583e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27268
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig26-geoserver-continually-connecting-c2-server.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_15414132.img.png/1725493922547/ 155 KB
156 KB 82ms
79ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_15414132.img.png/1725493922547/fig26-geoserver-continually-connecting-c2-server.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6305f99e66b3ae3c375efe4b1128ab3dcdc2d66c63b97ba6b891096de9b20b9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "26a3d-62153dc486c80"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: P6vIFw1KYsLJ8DcQLX3dVpvOAGnV0mCSOHSjDp3LYi7xQubqcItEqg==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:02 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 903d095eb644af4425e3808326bdc4e8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 158269
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig27-geoserver-ddos-attack-methods.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_275647643.img.png/1725493939962/ 64 KB
65 KB 415ms
414ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_275647643.img.png/1725493939962/fig27-geoserver-ddos-attack-methods.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

21aaea8d55693ea73c2e3d8afbf8358f3bfa56ae0d8a0abb07221a83373da2d5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "fe15-62153dd4bd2c0"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: v37z1HHcsn5RUqRkD24IknqYjXTL3KDARthQE4g_hr1X5oWDNDGLTw==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:19 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 65045
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig28-geoserver-creating-service.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_876069744.img.png/1725493958694/ 60 KB
61 KB 79ms
79ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_876069744.img.png/1725493958694/fig28-geoserver-creating-service.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8ff6ee1950e6f70a130f69e94e575f9d5f7c5de60be4be09311deedeb91e6d61

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "f051-62153de6dbd80"
Age: 15156
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: qgVJnu1gr1LTzlGdPTqLaBejiKT4C3cnZz_kdMZEkWT8XYkEJ4jNwA==
Date: Fri, 20 Sep 2024 09:02:26 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:38 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 8f23eaccc3b115094ce6ce3910c583e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 61521
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig29-geoserver-command-execution.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_463601972.img.png/1725493975114/ 122 KB
124 KB 914ms
911ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_463601972.img.png/1725493975114/fig29-geoserver-command-execution.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

c3a522b15c8dd585c2cb4e503fdce8145d08a8eccb0e2cd7138864bba293c843

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1e99b-62153df7123c0"
Age: 1284615
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: aA3HLn56kNOLMcvRodyorM4M7UInPKnYXNH5KeLLKTjJ_aKzgtFPIg==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:52:55 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 01348adbf285860dd21bc52b989abbe4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 125339
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig30-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_131843470.img.png/1725493991014/ 79 KB
80 KB 929ms
928ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_131843470.img.png/1725493991014/fig30-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

61c4417c2b9d4cba0069ef57a404bd5d9c7a7e4c768f57747b1c084cb9b373ce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "13af8-62153e06547c0"
Age: 1283668
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: UuR-gv9JI-xujCaZJqvKk6UvHkWJecnrR8phvWI-0rdr4DliCFOzeA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:53:11 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c3691d761a167bc90e6d3311843f48ce.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 80632
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig31-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1205773152.img.png/1725494041702/ 198 KB
199 KB 918ms
918ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1205773152.img.png/1725494041702/fig31-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e708a54b75ed6fd1fe7886153e485c91697f1ab440feed4efd10262575b7e7cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "31604-62153e3603840"
Age: 1284615
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: 9-aYoWWWU_x_lCceV3GsjTwxc3aP6P_qUlF5LsSeBbbVV5IZ0FJHOQ==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 8f23eaccc3b115094ce6ce3910c583e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 202244
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig32-geoserver-download-persistence.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1440737303.img.png/1725494062034/ 85 KB
87 KB 246ms
246ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1440737303.img.png/1725494062034/fig32-geoserver-download-persistence.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d98bf7483812de53be541b21b22b1cc519065b76ed31780f33bf8254e688812f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "155fb-62153e4a0a780"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: uwkV-QPCR94ud98VoZTRvlFnTBZjYxjjicSvPqZgf7x9WMViIn6prw==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 87547
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig33-geoserver-coin-miner-config.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1886495638.img.png/1725494085500/ 108 KB
110 KB 755ms
754ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1886495638.img.png/1725494085500/fig33-geoserver-coin-miner-config.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6277e3210b9fb4b3b4f0d452b7f91bda534fb23f8ecbe7f9b15dcdf85626cea6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1b0fc-62153e5ff9b40"
Age: 1284614
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: kfXB4dJg1bHKYPUubUMPIjFJZEO5jI3ZYk3Vwp7RhQzbvgUKsMNVog==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 903d095eb644af4425e3808326bdc4e8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 110844
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig34-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_438526620.img.png/1725494099321/ 69 KB
70 KB 71ms
71ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_438526620.img.png/1725494099321/fig34-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b124eed22afdf03abf94714c7632d5f462c0fca7725d014a4469f3b4a0f1083d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "11459-62153e6d53ac0"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 6nQHnQiuDGoBUOarYU1R0m9XKyyXdz8mldx5W3oiM_c-mwzrzqjqxw==
Date: Fri, 20 Sep 2024 13:15:02 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:54:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 70745
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig35-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_843460720.img.png/1725509976835/ 94 KB
96 KB 912ms
912ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_843460720.img.png/1725509976835/fig35-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

0be9fc1923bfa5bd67a699ff0f49420e460c09b27bcb63dd4d682a0fa2ef5b5a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "178b4-62157992d0600"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: KgRx4p-W4zIIjg_n8Ysmna85rioniRMin3_5bkCRWOEWO0Y96wS8cA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Thu, 05 Sep 2024 04:19:36 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 96436
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig36-geoserver-config-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_966339368.img.png/1725494131259/ 27 KB
28 KB 74ms
74ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_966339368.img.png/1725494131259/fig36-geoserver-config-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5072cb8f4c6522e91c53fa0b2c4a36a3aa078b5b78ac9d48f317649a055a1e1d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6c22-62153e8bd82c0"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: kHNm0ahSYNuQsOGUUZHKVbQ39FHaBXqjAZnYxX8hxkKuD74vWV_18A==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:55:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27682
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig37-geoserver-coin-miner.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_171562763.img.png/1725494150273/ 144 KB
145 KB 73ms
72ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_171562763.img.png/1725494150273/fig37-geoserver-coin-miner.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

5b7e10ef15a4fdfd73c69fa16e91aef21861455628f5ac87e72bb5f951e9976c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "23eb3-62153e9df6d80"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: qtv9P9gFAawie7zTF6YRH5cJNJ2zkDFEjgeQuNbuJ-pdV1bKAcs9Lw==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:55:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 147123
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig38-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1859114048.img.png/1725494168657/ 175 KB
176 KB 82ms
81ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1859114048.img.png/1725494168657/fig38-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

229849a4c44505b2599f1a321b139fb5ab32d04a4e0f8d9844b1827e60b80d9f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "2bb8d-62153eaf21600"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Ic5nOdwBEREzHg3YzymUUx1YMowdJIcxpCktMqct7GToN4eif2X0hA==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:56:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 179085
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig39-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_444774974.img.png/1725494192518/ 74 KB
75 KB 73ms
72ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_444774974.img.png/1725494192518/fig39-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b66a76be051ae670f5c2786172af1a704f1ecdb15aea3c3402fb42b9e5470598

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "127f9-62153ec604c00"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: XHkUrVd8fL8cw2QpWu9VWA0y0hlfucc44F3lt6MYoWatq063bZUNpw==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:56:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 c3691d761a167bc90e6d3311843f48ce.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 75769
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig40-geoserver-config-data.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1528863320.img.png/1725494220090/ 127 KB
128 KB 77ms
77ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1528863320.img.png/1725494220090/fig40-geoserver-config-data.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ec58ceb768e02c31b87f084fbe10f719b0c42d29c98fcca298688768c6f899e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "1fbf5-62153ee0b8b00"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ewuiXQZyJI0_4BxdndFQ5tkYB6sW3vPAJxdLGEB8t87-otmop7Ga_w==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c3691d761a167bc90e6d3311843f48ce.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 130037
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig41-geoserver-attack-packet.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_198093276.img.png/1725494235796/ 53 KB
54 KB 76ms
75ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_198093276.img.png/1725494235796/fig41-geoserver-attack-packet.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

7fc88a2ccff93251684fc0526a1ef83f6b65bccc949e449d86f4df1bf945da94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "d499-62153eef06cc0"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: JcJbOSkhRGzRj8uiapan2Xqjdyqms3PtbOgmkE6ok8Oh2lf2RYPVXw==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:15 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 01348adbf285860dd21bc52b989abbe4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 54425
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig42-geoserver-fraudulent-site.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_280569393.img.png/1725494252217/ 64 KB
66 KB 74ms
73ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_280569393.img.png/1725494252217/fig42-geoserver-fraudulent-site.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

a036dd51b9d09070b4cb8eaa91c1a5abac51f7027e9741c79343a35411be739c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "100f5-62153eff3d300"
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: _3Hgn6Lgmc8VNNuVgOmpOckUS5bqVM22Xc5BikIYcHS52csSwuFAOg==
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:57:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 903d095eb644af4425e3808326bdc4e8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 65781
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig43-geoserver-script-file-cron.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_212093578.img.png/1725494289081/ 35 KB
36 KB 245ms
244ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_212093578.img.png/1725494289081/fig43-geoserver-script-file-cron.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8a84bc1c645bc2d9b6e41e4e8b4582c2dbd3569b51df5ecedc989410e6be8fe7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "8ba4-62153f2286640"
Age: 1283669
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: IQE0IEIok7iwymOxJ2bjJGmLAVMfrATml8hPLI4dEspDeD7rjQCr-g==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 01348adbf285860dd21bc52b989abbe4.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35748
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig44-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1895558288.img.png/1725494284576/ 26 KB
27 KB 247ms
246ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_1895558288.img.png/1725494284576/fig44-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f8f726a217af8471c5c0e2c11fca16865b7dc42485185311fcbfa0603a4f7120

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "6813-62153f1dc1b00"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: DJRtB849BedURJeZnU8bb6AuC1qCSCG-Iq79qBVXUXzzCCIag6ju9A==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 903d095eb644af4425e3808326bdc4e8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 26643
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK fig45-geoserver-script-file.png
www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_849748280.img.png/1725494304387/ 30 KB
31 KB 251ms
250ms Image
image/png 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401/_jcr_content/root/responsivegrid/table_content/par/image_849748280.img.png/1725494304387/fig45-geoserver-script-file.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

da9671920127171a9289888088dc3d9f3b62f2af8c3ac142f456faa1d49eccda

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
ETag: "77a6-62153f30d4800"
Age: 1284546
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: OMqIIxpEBVvqDwvDgcVYqjz0oqqtvGaRGtQ-YfmdFPFe6sPGX3bLUA==
Date: Fri, 20 Sep 2024 13:15:04 GMT
Content-Type: image/png
Last-Modified: Wed, 04 Sep 2024 23:58:24 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c3691d761a167bc90e6d3311843f48ce.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 30630
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/ 99 KB
24 KB 41ms
31ms Fetch
application/x-javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/68cad325-7b77-4fcb-9f98-ba2e81aa9045/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: SDJFQYswktbx6w5cJzzMRQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF2B6F9C71
age: 44530
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 21 Sep 2024 13:15:00 GMT
date: Fri, 20 Sep 2024 13:15:00 GMT
content-type: application/x-javascript
last-modified: Thu, 28 Dec 2023 19:57:06 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-ms-request-id: 16a02b50-101e-0023-7a72-79a340000000
cf-ray: 8c6214eda8f58095-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24004
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 13 KB
4 KB 27ms
25ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: W9e0YobmEbvdB0V9OmpQkw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735209A34D6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 44958
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:00 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: e7ba9f8a-a01e-0009-5512-247c50000000
cf-ray: 8c6214ee29d68095-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3329
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 45 KB
12 KB 47ms
46ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: zNsRoM1FEmsEgJoYMCNTng==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D897352245C4EA
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 47502
x-content-type-options: nosniff
date: Fri, 20 Sep 2024 13:15:00 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:53 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
x-ms-request-id: 77f313b5-301e-0034-7eb4-210a4b000000
cf-ray: 8c6214ee29db8095-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11755
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 509 KB
121 KB 105ms
5ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cfbffc5a6b6598cb0bf93565da00397f881e0198bf2f24c8d963e4c7cfb45abf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "859a562c3003b9443ad4e70b3020dad9:1726790028.604703"
expires: Fri, 20 Sep 2024 14:15:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 123481
date: Fri, 20 Sep 2024 13:15:00 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:48 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 id Show response
dpm.demdex.net/ 368 B
915 B 114ms
6ms XHR
application/json 3.112.147.252
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1726838100492

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.112.147.252 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-112-147-252.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

4ba983e91c925e7b64efe7f971562edadf297d05f8f648f8d8060aa955649ac0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-1-v062-040bee5db.edge-tyo3.demdex.com 1 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: hctbVHyoSks=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.fortinet.com
content-length: 309
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:00 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 dest5.html
fortinet.demdex.net/ Frame CC85 0
0 169ms
0ms Document
text/html 18.177.189.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.177.189.218 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-177-189-218.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 20 Sep 2024 13:15:00 GMT
dcs: dcscanary-prod-tyo3-1-v081-0515d025b.edge-tyo3.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Tue, 13 Aug 2024 07:21:06 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: kUyni7bOS3U=

GET
H2

200

ibs:dpid=411&dpuuid=Zu11VQAAAFSjTgOn
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=30541821646655490073624486381940051027
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11VQAAAFSjTgOn

42 B
716 B

22ms
11ms

Image
image/gif

3.112.147.252
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11VQAAAFSjTgOn

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Server

3.112.147.252 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-112-147-252.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-1-v062-0d937dcc9.edge-tyo3.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: KIfptAcSQ28=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zu11VQAAAFSjTgOn
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Fri, 20 Sep 2024 13:15:01 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

POST
H2 200 delivery Show response
fortinet.tt.omtrdc.net/rest/v1/ 351 B
831 B 174ms
23ms XHR
application/json 63.140.50.233
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.tt.omtrdc.net/rest/v1/delivery?client=fortinet&sessionId=72023157eef2440cbdd770195ed046d6&version=2.10.0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.50.233 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a70d3b4d492439d9ee9225cd56601b2f229938c2a6d74e12398e379d43b84114

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 5acb7e33-3620-43c5-a1c6-ba9447948983
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://www.fortinet.com
date: Fri, 20 Sep 2024 13:15:00 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 35 KB
13 KB 44ms
17ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "d8232f86c8016a8e0acaa7ecfdf72b3e:1722493571.189276"
expires: Fri, 20 Sep 2024 14:15:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 13012
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 3 KB
2 KB 44ms
18ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "bb4b6453e3ab80111a2b227318d22efb:1722493571.614634"
expires: Fri, 20 Sep 2024 14:15:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1597
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 0786.js Show response
script.crazyegg.com/pages/scripts/0117/ 7 KB
3 KB 620ms
553ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8db92e7cdc1ad40168c42e93b05d842e056d8a5b83ae96b95d2b1c546f828196

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1048
cf-polished: origSize=6998
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: text/javascript
last-modified: Fri, 20 Sep 2024 12:57:33 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c6214f58f35e07a-NRT
access-control-allow-origin: *
ce-version: 11.5.282
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 70 KB
19 KB 90ms
17ms Script
application/javascript 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2c88a96aaccfda2bf3f3c29d069fea858423e9cebcc1392a1021ec76538498ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66e78018-1167c"
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 16:15:01 GMT
accept-ranges: bytes
content-length: 19151
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Mon, 16 Sep 2024 00:47:20 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 28 KB
9 KB 602ms
521ms Script
application/x-javascript 23.32.225.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.225.140 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-225-140.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8489534bde4ad3c3cedebecd11b9babe653de6b413922ec2b877c5bfcb33ee3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Content-Encoding: gzip
ETag: "7437febf15b08e005ac33eb9fc2707ae:1721634584.416148"
Connection: keep-alive
Expires: Fri, 20 Sep 2024 13:35:01 GMT
Accept-Ranges: bytes
X-CC: JP
Content-Length: 8614
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:01 GMT
Content-Type: application/x-javascript
Last-Modified: Mon, 22 Jul 2024 07:46:05 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 25f2dd15-02c6-4e7a-bc8b-c5722b49624d Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 1284ms
77ms Script
application/javascript 34.124.133.154
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.124.133.154 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 154.133.124.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-request-id: F_b2Gwxa7FoxncSol5cB
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
15 KB 1166ms
22ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "803483b3aaadb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 541BE927643A494AAB0F6D96FC8ED877 Ref B: TYO201100114029 Ref C: 2024-09-20T13:15:03Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14402
date: Fri, 20 Sep 2024 13:15:02 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 15:43:41 GMT
vary: Accept-Encoding

GET
H2 200 RCac955f2e1e97429197e1e31aaec22e86-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1 KB
942 B 50ms
13ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCac955f2e1e97429197e1e31aaec22e86-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f90b5ef7baa9dfccda582eb0ec80a2e2848cd5b3edc866629cda33cf4ff6df48

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 685
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 9 KB
2 KB 50ms
13ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 10fc9a12b905f9f21665f11fa5b183eae31166f74fce090bf179eb4c823b5ecc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1846
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 358 B
485 B 50ms
13ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2589fe281a342d19f8ddcd924727496b916202c4e42edb2553f25074746db938

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 229
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 703 B
684 B 50ms
14ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 15c2c29198d9315260cc26261e96a036d215fa28a46836302a576392e0e20ecd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 427
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 360 KB
118 KB 1253ms
88ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

217ba4b460ea7bc3ea3dcf1e24b56335d36a7a70c748d3d778a00378918b0d30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:03 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120795
date: Fri, 20 Sep 2024 13:15:03 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 RC06cd6a06a307489f80febc787462cb12-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 635 B
642 B 51ms
15ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC06cd6a06a307489f80febc787462cb12-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 320f37b3eca2011055c9ab5a10b5de0f57a22fd740e504fe7e02c9898041abbb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 385
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/site/ 10 KB
2 KB 46ms
33ms XHR
application/json 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f313c8c3aaec2c1b82bdf04b99d12b5b456dd6e4ccb2957e7a584c42683eba5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 1048
date: Fri, 20 Sep 2024 13:15:01 GMT
content-type: application/json
last-modified: Fri, 20 Sep 2024 12:57:33 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c6214f929018095-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1782
ce-version: 11.5.282
server: cloudflare

GET
H/1.1 200
OK unifiedPixel Show response
tr.outbrain.com/ 53 B
321 B 1277ms
116ms Fetch
image/gif 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?au=false&bust=08338080515448985&referrer=&cht=ot&marketerId=00ad3119690e692fd6990245f9741ea8f1&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&g=0&obApiVersion=1.1&obtpVersion=2.0.5

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

38.133.127.191 Sacramento, United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 54
content-encoding: br
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: image/gif;
x-traceid: 3c92bc8141fc5c873fdc7dd6c6da201c

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 1290ms
132ms Script
application/javascript 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

38.133.127.191 Sacramento, United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 39
content-encoding: br
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: application/javascript
x-traceid: d1118570656c74ed6ce9dcfacb8a9597

GET
H/1.1 200
OK 00ad3119690e692fd6990245f9741ea8f1 Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
516 B 2924ms
3ms Script
text/html 23.32.225.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.32.225.140 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-32-225-140.deploy.static.akamaitechnologies.com

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
Cache-Control: max-age=60
ob-sent-time: 1726821107559
Content-Encoding: gzip
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Expires: Fri, 20 Sep 2024 13:16:06 GMT
Access-Control-Allow-Origin: *
X-CC: JP
Content-Length: 22
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:06 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
x-traceid: 63b794c791c786e18da33e49c2470af7

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 29ms
14ms Fetch
text/html 23.32.225.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.225.140 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-225-140.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Connection: keep-alive
Observe-Browsing-Topics: ?1
Expires: Fri, 20 Sep 2024 13:35:03 GMT
Access-Control-Allow-Origin: *
X-CC: JP
Content-Length: 26
X-RG: AS
Date: Fri, 20 Sep 2024 13:15:03 GMT
Content-Type: text/html

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 37ms
14ms XHR
text/html 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-118-161.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.fortinet.com
content-length: 7
date: Fri, 20 Sep 2024 13:15:02 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 18 B
305 B 1138ms
3ms XHR
text/html 2600:140b:1c00:39::1732:7614
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:1c00:39::1732:7614 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: e72fc9693b94bd6f4cea4fa172adc70989eca7c72cbdcb48f51ceaa7063ab230

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:ac8:40:1e::2e
expires: Fri, 20 Sep 2024 13:15:03 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1726838102021_388834580_450012_32_981_1_1116_219";dur=1
access-control-allow-origin: https://www.fortinet.com
content-length: 18
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 187ms
187ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A01%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:03 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 163ms
162ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%225eeecf22b2d12a77a14639dce97b7a36%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227381d1d7c753fe2d8e217c3fdc44c0f17418dcc4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2020%20Sep%202024%2013%3A15%3A01%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:03 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 744 B
718 B 20ms
12ms XHR
application/json 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: 904ada5a93d55f8c5412c4472a62bfbc46e215422ebdea166d95ed3434d97d4f

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-encoding: gzip
x-6si-region: ap-northeast-1a
access-control-allow-credentials: true
x-trace-id: 6790980022173164632
access-control-allow-origin: https://www.fortinet.com
content-length: 395
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: nginx

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 990ms
8ms Preflight 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Fri, 20 Sep 2024 13:15:03 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: ap-northeast-1a
x-trace-id: 2909691465587093550

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 165ms
164ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A03%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A01%20GMT%22%2C%22timeSpent%22%3A%221335%22%2C%22totalTimeSpent%22%3A%221335%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:03 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 db7349b994413162218df5c920535415.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 103 KB
35 KB 46ms
33ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df9f1f8f4deeec8193dbcf3074a9e4767db05cc6c3b4dca6a9cafff884fb0816

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1057
cf-ray: 8c6215028b08e07a-NRT
cf-polished: origSize=105321
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: text/javascript
last-modified: Fri, 06 Sep 2024 19:46:55 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 168ms
167ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A40%3A1e%3A%3A2e%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:03 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 634 B
606 B 36ms
36ms Fetch
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: c49ef55655c4da0adfe3cd86a5db075951a3a1aca41788b409188e5de27a06a2

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
EpsilonCookie: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-encoding: gzip
x-6si-region: ap-northeast-1a
access-control-allow-credentials: true
access-control-allow-origin: https://www.fortinet.com
content-length: 320
date: Fri, 20 Sep 2024 13:15:06 GMT
content-type: application/json
vary: Origin, Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
103 KB 102ms
101ms Script
application/javascript 2404:6800:4004:818::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:818::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b4cf9a1c5e59761a8992b1692b7490a2c5bc428dfb4f84fc3b342edc51c8c06a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:03 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104906
date: Fri, 20 Sep 2024 13:15:03 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 17532650.js Show response
bat.bing.com/p/action/ 370 B
426 B 26ms
25ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17532650.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

cee682bc57d94c16933b0422aa0bd7ad8c7a6e04643eb7ce170e2d5ce6e25b48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A1797272A3A84DA89A3C0D864EFC38C6 Ref B: TYO201100114029 Ref C: 2024-09-20T13:15:03Z
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 251 KB
88 KB 95ms
94ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

266c05a4179d82e44435b53e3c59feca1da023ca374782167149451932672d70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 90402
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 96ms
94ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ae7508b6af434ce1865c89b657732af23480ae3326b43fdcdcc43ac679723c10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79028
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 231 KB
83 KB 100ms
99ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

4e087b4fdf2d01e82e172c013dadf27dd879737dd595df92fa435f4662538d51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 85155
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
86 KB 112ms
101ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f4eef873faaecfdeedc996d3f32d0c4d6775a01d0069afe29eb08e0080159899

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:03 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 88087
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 s29072869293654
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/ 43 B
388 B 2559ms
18ms Image
image/gif 63.140.50.191
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/s29072869293654?AQB=1&ndh=1&pf=1&t=20%2F8%2F2024%2022%3A15%3A3%205%20-540&sdid=1550954643D6E342-763410AA92CE84D0&mid=30907364271788772553659985250725211611&aamlh=11&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Athreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&c7=Entire%20Site&c8=New&v25=30907364271788772553659985250725211611&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Athreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v106=Voluntari&v107=Ilfov&v108=Romania&v126=NA&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.50.191 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

etag: 3708356596270235648-4618411120968140500
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:15:06 GMT
p3p: CP="This is not a P3P policy"
date: Fri, 20 Sep 2024 13:15:06 GMT
last-modified: Sat, 21 Sep 2024 13:15:06 GMT
vary: *
x-adobe-ingress: hp
content-type: image/gif;charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
pragma: no-cache
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block
server: jag

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 174ms
173ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A04%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A03%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%222340%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:04 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:04 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 204 0
bat.bing.com/action/ 0
360 B 24ms
24ms Image
text/plain 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=6bee8eee-590e-411e-98c9-ff750f5265d9&sid=59bfa690775211efb7958bbdf451304c&vid=59bfaa00775211ef9c3141fe83c3acaa&vids=1&msclkid=N&pi=918639831&lg=ja-JP&sw=1600&sh=1200&sc=24&tl=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&kw=FortiGuard%20Labs%20Threat%20Research,Cara%20Lin&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&r=&lt=2313&pt=1726838097319,,,,,109,110,111,111,252,178,252,326,395,340,2251,2251,2313,,,&pn=0,0&evt=pageLoad&sv=1&cdb=AQED&rn=910970

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B030E9402D244F2086944FACDA7C0DEA Ref B: TYO201100114029 Ref C: 2024-09-20T13:15:04Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:04 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 171ms
170ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A05%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A04%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%223344%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:05 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:05 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/sampling/ 46 B
258 B 19ms
19ms XHR
application/json 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/sampling/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ef0e68967411e0314dcc9b45416c54100ebf112f0fc6dc08cc3e1f1f9fa0436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 1050
date: Fri, 20 Sep 2024 13:15:05 GMT
content-type: application/json
last-modified: Fri, 20 Sep 2024 12:57:35 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8c62150e8d038095-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 65
ce-version: 11.5.282
server: cloudflare

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 2794ms
10ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,epsiloncookie,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,epsiloncookie,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Fri, 20 Sep 2024 13:15:06 GMT
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: ap-northeast-1c

GET
H2 200 clock Show response
tracking.crazyegg.com/ 40 B
147 B 369ms
54ms XHR
text/plain 43.201.174.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?t=1&tk=329ee1373036c5ddcda74cf257baa0a6&u=1170786&s=424000&p=%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&v=ce73ca188bf32924b31ba131f39a1c4fea46b686&f=fortinet.com%2Fblog%2Fthreat-research%2F*&ul=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.201.174.92 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-201-174-92.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 0cb27f8572cbc2abecb4fe2d5291d6c4f6f21f7e7d7e3ceb0b57211b00e1b79a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store
access-control-allow-origin: *
content-length: 40
date: Fri, 20 Sep 2024 13:15:06 GMT
content-type: text/plain
server: awselb/2.0

GET 31169441-3563-48c3-8597-515718712000
https://www.fortinet.com/ Frame 0
0

GET
H2 200 activityi;fledge=1;src=10050195;npa=0;auiddc=1538869018.1726838104;ps=1;pcor=323568843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=1...
td.doubleclick.net/td/fls/rul/ Frame 9CC6 0
0 454ms
44ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=1538869018.1726838104;ps=1;pcor=323568843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:07 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;src=10050195;npa=0;auiddc=1538869018.1726838104;ps=1;pcor=323568843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l...
ad.doubleclick.net/ 42 B
65 B 180ms
43ms Image
image/gif 172.217.26.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;src=10050195;npa=0;auiddc=1538869018.1726838104;ps=1;pcor=323568843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.26.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Fri, 20 Sep 2024 13:15:06 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET activity;register_conversion=1;src=10050195;npa=0;auiddc=1538869018.1726838104;ps=1;pcor=323568843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123...
ad.doubleclick.net/ 0
0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/ 6 KB
2 KB 531ms
62ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/?random=1726838106592&cv=11&fst=1726838106592&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

097fa6ca8edc9ac17a821a258fbf1d4357e4704d7f9056199ef364df1d1377d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2406
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 729495989
td.doubleclick.net/td/rul/ Frame 87E9 0
0 427ms
107ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/729495989?random=1726838106592&cv=11&fst=1726838106592&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:07 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 6 KB
2 KB 450ms
61ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1726838106678&cv=11&fst=1726838106678&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

ffc203bbbd97d035fe4167f82bc351cbb08bd237b85e60285f33a1f44ef23886

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2395
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 609297413
td.doubleclick.net/td/rul/ Frame FAA2 0
0 135ms
117ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/609297413?random=1726838106678&cv=11&fst=1726838106678&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:07 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 6 KB
2 KB 342ms
62ms Script
text/javascript 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1726838106770&cv=11&fst=1726838106770&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

12e52d0f46a9b73b04be82a6c628fea98bb3ad9652332ce7faff9b4447e2d3ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2417
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 662878185
td.doubleclick.net/td/rul/ Frame 19B3 0
0 124ms
113ms Document
text/html 2404:6800:4004:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/662878185?random=1726838106770&cv=11&fst=1726838106770&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:07 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 347ms
85ms Fetch
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-38BQ9XFDT4&gtm=45je49j0v9191763579za200&_p=1726838101892&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=2121178243.1726838107&ul=ja-jp&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726838106&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&dt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=9575
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 51 KB
18 KB 276ms
16ms Script
application/javascript 2400:52e0:1501::1193:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1501::1193:1 , Japan, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-JP1-1193 /
Resource Hash: ab5b000d7c8c84f2cc6dbaacd88498126fa4b2fcb04cf14ae9fcd8eef9623760

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"66e2dd78-cca5"
cdn-fileserver: 869
date: Fri, 20 Sep 2024 13:15:07 GMT
cdn-storageserver: JP-394
last-modified: Thu, 12 Sep 2024 12:24:24 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 09/19/2024 20:09:41
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 88c4eb2889bf1af27f673676d6eca812
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 1184
server: BunnyCDN-JP1-1193
cdn-requestcountrycode: JP

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 178ms
177ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A05%20GMT%22%2C%22timeSpent%22%3A%221559%22%2C%22totalTimeSpent%22%3A%224903%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:07 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 ca6be1649b2c6bd5aa79ebaa229fa676.js Show response
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ 20 KB
8 KB 20ms
20ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ca6be1649b2c6bd5aa79ebaa229fa676.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7701282ea59743a1d336ee5ede4e6805ca9572c28ad013fa956fb39f18de0d69

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1059
cf-ray: 8c6215185cdce07a-NRT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Fri, 20 Sep 2024 13:15:06 GMT
content-type: text/javascript
last-modified: Wed, 18 Sep 2024 13:30:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 192ms
191ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=ni%3Aepsv&q=%7B%22or%22%3A%22ap-northeast-1a%22%2C%22nr%22%3A%22ap-northeast-1a%22%2C%22orl%22%3A1184%2C%22nrl%22%3A3594%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22RO%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22RO%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22company_match%5C%22%3A%5C%22No%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22No%20company%20name%20or%20domain%20was%20found%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22match%22%3Afalse%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:07 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
519 B 269ms
245ms XHR
application/json 13.225.183.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.183.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-183-12.nrt57.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.fortinet.com/

Response headers

x-amz-apigw-id: eZ9GVEGGoAMEroQ=
x-amzn-trace-id: Root=1-66ed755b-5f1b2cf260b2da6714dca8a3;Parent=30d133fa3b64358a;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 0ed3cbbe-abf4-4715-9687-d5c410a2473c
via: 1.1 c8cb49c2b391bae10c56b1a57df509d0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: raOf8_SR3GH8Mcij_tgEk2oIeM-I1A7vSiBecZnS6xV2ZYqT_oVelQ==
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: application/json
x-amz-cf-pop: NRT57-C4
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 182ms
181ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A6020.39999961853%2C%22duration%22%3A2839.7000002861023%2C%22initiatorType%22%3A%22fetch%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A6020.39999961853%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A8860.099999904633%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22ap-northeast-1a%22%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22RO%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22RO%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Romania%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Ilfov%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Voluntari%5C%22%2C%5C%22company_match%5C%22%3A%5C%22No%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22No%20company%20name%20or%20domain%20was%20found%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=&d=1&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:07 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 418ms
182ms Preflight
application/json 13.225.183.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.183.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-183-12.nrt57.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Fri, 20 Sep 2024 13:15:07 GMT
via: 1.1 c8cb49c2b391bae10c56b1a57df509d0.cloudfront.net (CloudFront)
x-amz-apigw-id: eZ9GTHdWoAMEFxg=
x-amz-cf-id: W9uIidjOg-GAhZ3bFYTGXqhdh31j4PtZ-mziCf8iihko9JO7I7l8SQ==
x-amz-cf-pop: NRT57-C4
x-amzn-requestid: 72ea0d10-8218-4dc6-9823-f630be8b9270
x-cache: Miss from cloudfront

GET
H3 200 9ca7c9e85a6ce51bd9b80280f971319a.js Show response
script.crazyegg.com/pages/versioned/tracking-scripts/ 95 KB
31 KB 30ms
26ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/tracking-scripts/9ca7c9e85a6ce51bd9b80280f971319a.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: daaa79b81fa49a10852df79446783b9c51de167ee31aaff722e030c6cacc674b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 1063
cf-ray: 8c6215193e2ae07a-NRT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: text/javascript
last-modified: Mon, 16 Sep 2024 20:30:38 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
64 B 185ms
68ms Image
image/gif 142.251.222.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1726838106678&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfBZtDZj4HxVBnQSQAHlCTc1yPC9bnkw&random=3676496607&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.222.36 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt13s72-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/609297413/ 42 B
64 B 225ms
98ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/609297413/?random=1726838106678&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfBZtDZj4HxVBnQSQAHlCTc1yPC9bnkw&random=3676496607&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/662878185/ 42 B
64 B 201ms
84ms Image
image/gif 142.251.222.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/662878185/?random=1726838106770&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnf_CC075sxqoyuuhkJ8hAkj8hw_X4ViMcOtPwcxuRm2cyoM_5R&random=3298803257&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.222.36 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt13s72-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/662878185/ 42 B
64 B 227ms
102ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/662878185/?random=1726838106770&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnf_CC075sxqoyuuhkJ8hAkj8hw_X4ViMcOtPwcxuRm2cyoM_5R&random=3298803257&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/729495989/ 42 B
64 B 182ms
67ms Image
image/gif 142.251.222.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/729495989/?random=1726838106592&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfIRjSq_fdHnqmSPukw6m-t1cgm3h9Ng&random=545712624&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.222.36 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt13s72-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.jp/pagead/1p-user-list/729495989/ 42 B
64 B 227ms
102ms Image
image/gif 142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/729495989/?random=1726838106592&cv=11&fst=1726837200000&bg=ffffff&guid=ON&async=1&gtm=45be49j0za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=1538869018.1726838104&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfIRjSq_fdHnqmSPukw6m-t1cgm3h9Ng&random=545712624&rmt_tld=1&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 api.min.css
a.omappapi.com/app/js/ 10 KB
3 KB 127ms
23ms Stylesheet
text/css 2400:52e0:1501::1193:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1501::1193:1 , Japan, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-JP1-1193 /
Resource Hash: 71e3c0057bec6dab5d49a1b6994c8e4fffa97614ba115bc8747a2be7c43ed048

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"66e2dd79-2644"
cdn-fileserver: 681
date: Fri, 20 Sep 2024 13:15:07 GMT
cdn-storageserver: JP-394
last-modified: Thu, 12 Sep 2024 12:24:25 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 09/19/2024 20:09:41
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: d7ada846eb96121dcb445ed39674b7cb
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 1185
server: BunnyCDN-JP1-1193
cdn-requestcountrycode: JP

GET
H2 401 39852 Show response
api.omappapi.com/v2/embed/ 165 B
594 B 355ms
231ms XHR
application/json 2606:4700:3108::ac42:2af8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2af8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-user-agent: standard--
cf-cache-status: DYNAMIC
expires: Fri, 20 Sep 2024 13:16:10 GMT
x-cache: Error from cloudfront
x-amz-cf-id: _w8Uk-lgZpjrtLq7SS260Hsa-VhbqZvDDhk4kghGRPaNQzDazxKtZw==
date: Fri, 20 Sep 2024 13:15:07 GMT
x-cache-config: 0 0
content-type: application/json
vary: Accept-Encoding, User-Agent
access-control-allow-headers: X-CSRF-Token
cache-control: public, max-age=120, stale-while-revalidate=1800
via: 1.1 2e09729c09747cfaa237f08151b53d06.cloudfront.net (CloudFront)
cf-ray: 8c62151acb3a2689-NRT
access-control-allow-origin: *
content-length: 165
x-amz-cf-pop: NRT57-P3
server: cloudflare

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 149ms
50ms Script
text/javascript 2606:4700::6812:1247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1247 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 76835
via: 1.1 google
cf-ray: 8c62151aae53809c-NRT
expires: Fri, 20 Sep 2024 13:35:07 GMT
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK tag.js Show response
abm-tracking.demandscience.com/ 2 KB
2 KB 490ms
136ms Script
application/javascript 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/tag.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: public, max-age=0
ETag: W/"82b-18f5d3a3d78"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2091
Date: Fri, 20 Sep 2024 13:15:07 GMT
Content-Type: application/javascript; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Thu, 09 May 2024 12:00:49 GMT

GET
H2 200 wid.tracker.js Show response
tmp.argusplatform.com/js/ 8 KB
3 KB 361ms
228ms Script
text/javascript 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://tmp.argusplatform.com/js/wid.tracker.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preloadmax-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preloadmax-age=31536000
cache-control: public, must-revalidate, max-age=30
x-dns-prefetch-control: off
content-encoding: br
etag: "28476869"
referrer-policy: same-origin
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 1; mode=block
content-type: text/javascript
last-modified: Sat, 08 Jun 2024 11:51:22 GMT
vary: Accept-Encoding
x-azure-ref: 20240920T131507Z-r1677749c8699522r2qb94qg9g0000000bvg00000001pe3s

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ 161 B
712 B 577ms
187ms Script
text/javascript 216.200.232.249
PAEDAE-INC

General

Check archive.org

Show headers Download Go to

Full URL

https://pixel.mathtag.com/event/js?mt_id=1629896&mt_adid=260855&mt_exem=&mt_excl=&v2=&v3=&s1=&s2=&s3=&v1=en:blog:threat-research:threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.200.232.249 Frederick, United States, ASN30419 (PAEDAE-INC, US),

Reverse DNS

Software

MT3 1668 f41eadd master ord ord-pixel-x57 config_version:"2232" /

Resource Hash

98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457

Security Headers

Name	Value
Strict-Transport-Security	31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Strict-Transport-Security: 31536000
Cache-Control: no-cache
Content-Encoding: gzip
Connection: close
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Fri, 20 Sep 2024 13:15:07 GMT
X-XSS-Protection: 0
Content-Type: text/javascript
Server: MT3 1668 f41eadd master ord ord-pixel-x57 config_version:"2232"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 316 KB
105 KB 129ms
126ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f1f9db6482608adf3e3a8afae1696750668fa36428265807fbdcfc43eb6691f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:15:07 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 107002
date: Fri, 20 Sep 2024 13:15:07 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H/1.1 200
OK footer-links.json Show response
www.fortinet.com/content/dam/fortinet-blog/ 310 KB
36 KB 115ms
109ms XHR
application/json 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/footer-links.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "4d8dc-61d89b0f78340-gzip"
Age: 5510999
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: DRVwWpgNCtwcRQtKrO0K99tk_lJytNHBxPdn9EeSBOGek-wbP4853Q==
Date: Fri, 20 Sep 2024 01:13:59 GMT
Content-Type: application/json
Vary: Accept-Encoding
Last-Modified: Thu, 18 Jul 2024 18:24:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35378
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

POST
H2 201 v11 Show response
tracking.crazyegg.com/ 0
82 B 207ms
77ms XHR
text/plain 43.201.174.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.201.174.92 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-201-174-92.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/gzip
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: text/plain
server: awselb/2.0

OPTIONS
H2 204 v11
tracking.crazyegg.com/ Frame 0
0 94ms
81ms Preflight 43.201.174.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.201.174.92 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-201-174-92.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public, max-age=86400
date: Fri, 20 Sep 2024 13:15:07 GMT
server: awselb/2.0
vary: Access-Control-Request-Headers, Origin, Access-Control-Request-Method

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
442 B 226ms
212ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1726838107420&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
ibc_rate_tier: 1247773
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Fri, 20 Sep 2024 14:15:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AD-8ljvFtmruvG-BeaISzW9FYavkg5FqV5g7I1paGxUsAvdULzzOCGypINP4g6eF2HOuHDSV40k
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 215ms
147ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1726838107420&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 20 Sep 2024 13:15:07 GMT
expires: Fri, 20 Sep 2024 13:15:07 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AD-8ljsDTZ-ryB_y2S8tMKvzXrGUa0ZR_fbnM4ys9uARd_5sfFVAvvpm25qoIhTh-IdJqbi_C00

GET
H2 401 / Show response
pixels.argusplatform.com/wh/track/ 205 B
468 B 1016ms
969ms XHR
application/json 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838108179686794&event_type=page_request&timestamp=1726838108&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20240920T131507Z-r1677749c8699522r2qb94qg9g0000000bxg0000000130ak

GET
H2 200 fp.min.js Show response
cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/ 33 KB
15 KB 141ms
50ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY"
age: 13671
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220049-FRA, cache-tyo11944-TYO
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15023
x-jsd-version: 3.4.2

GET
H2 200 site-visitors Show response
intentstream.contanuity.com/api/ 115 B
374 B 139ms
133ms Fetch
application/json 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-pixel-auth: true
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=15724800; includeSubdomains
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 115
date: Fri, 20 Sep 2024 13:11:33 GMT
content-type: application/json; charset=utf-8
vary: origin
server: nginx

OPTIONS
H2 200 site-visitors
intentstream.contanuity.com/api/ Frame 0
0 435ms
113ms Preflight 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-pixel-auth
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-pixel-auth
access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
content-length: 0
date: Fri, 20 Sep 2024 13:11:32 GMT
server: nginx
strict-transport-security: max-age=15724800; includeSubdomains

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 81ms
49ms Fetch
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-JH142QCQCJ&gtm=45je49j0v893708426za200zb9123037237&_p=1726838101892&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=2121178243.1726838107&ul=ja-jp&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726838107&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&dt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_ss=1&_ee=1&tfd=10613
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 20 Sep 2024 13:15:07 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 192ms
179ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A07%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A06%20GMT%22%2C%22timeSpent%22%3A%221059%22%2C%22totalTimeSpent%22%3A%225962%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:08 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
BLOB 200
OK 9787139a-2721-4dcc-8712-b0ff9be4f582
https://www.fortinet.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.fortinet.com/9787139a-2721-4dcc-8712-b0ff9be4f582
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H2 200 RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
1015 B 47ms
5ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: af89d0f65e1c53f2831c1b73f25ee3053fddc6551962dc58eada982a2fd99bdd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 758
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7be3d22b2fd6487ca9390477738587fe-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
756 B 45ms
3ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC7be3d22b2fd6487ca9390477738587fe-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 59d12a10e99345ccbe1776752be1dcab5d337248fb1f523fb3cf93ffecf3a779

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC407b573180554ea6b11eecdc31ecbd3f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
756 B 45ms
5ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC407b573180554ea6b11eecdc31ecbd3f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2d0ddcf9662d44f133470ee7c926c568e540874718195167d7ce2eae31839a2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC1d92f04752ae42a38e54de48cb85adf4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 661 B
648 B 45ms
6ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC1d92f04752ae42a38e54de48cb85adf4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4b1017ddd583b8790466a28987a1dabd2d750fcbc0dbffbf263bee2e4cd35791

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 391
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf940460311f349b5af69d075bdef61d4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 368 B
492 B 44ms
6ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCf940460311f349b5af69d075bdef61d4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 956915db9ed8f96ac4ee123a7909637e7db25f3ea20e41927c5fcc4fd50108ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 235
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 754 B
704 B 38ms
6ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a57c6cd6129a6ae679af72011e4529d2c322ff41ca4933dedd76150ffcae369

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 447
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
971 B 38ms
6ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 73ade03dfeae221bb318514f70aa5ae9c9c653b6871008ef9a3596f9255a78f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 714
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1021 B
857 B 38ms
6ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ee555b56d11e10b0a60e50d84be13221d318b328d16a7b59d77bb5dc7007e4d2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 601
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcd84e40d19c24776bef77836ab2f8df6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 819 B
758 B 33ms
4ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 7a520fb2812687266f06520e650deb9dece37e49629623c4be612b1f561e11df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 502
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 388 B
498 B 28ms
4ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8dbdd526d3da8b4924bc169cb3faee88cda6da11742ef935ae2e916a17b7d978

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 242
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5c60a51709a94068afbf065e1448b617-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 664 B
657 B 28ms
4ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC5c60a51709a94068afbf065e1448b617-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 88a5f8b5bcd4b32ed398b199bfc0ecf20ba41bf544d2ca04bc40111db7c66ab3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 401
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7675832323134b109ff7c59296e2d2ca-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 1 KB
797 B 28ms
4ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC7675832323134b109ff7c59296e2d2ca-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d04f03c209c8b79223d1147dec2771c3e87a401dc1348b7dd10de0aa7d22297f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 540
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 2 KB
981 B 28ms
4ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8109fbd42099eef3aed0564d81e4502bade4a64b6bd5174894f0f1e8019cd421

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 724
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/ 966 B
809 B 28ms
5ms Script
application/x-javascript 2600:140b:a00:383::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/8fc5b8880351/RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:a00:383::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bb50d0022dac04a6c6a2fc5edf927a4682c8e6b73a970546c75ff118f06ad4e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "3c8095c9984058752de3a2aa7f49af7e:1726790030.070843"
expires: Fri, 20 Sep 2024 14:15:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 552
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/x-javascript
last-modified: Thu, 19 Sep 2024 23:53:50 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 p Show response
i.simpli.fi/ 798 B
762 B 131ms
81ms Script
application/javascript 34.124.133.154
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp
Requested by: Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.124.133.154 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 154.133.124.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: 71a46dab6ee04f3c70340e06651cc5a57ccb8c30e7635dfb8d487cbe8d657b80

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: openresty

GET
H/1.1 200
OK favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/ 318 B
2 KB 109ms
96ms Other
image/vnd.microsoft.icon 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "13e-565c628eb6a00-gzip"
Age: 6105643
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: PVfOuK2zAsS-6AI-wtxGSs4US7iu6qnjBNKfYPRICMrzCJCr3CSP4Q==
Date: Fri, 20 Sep 2024 13:15:06 GMT
Content-Type: image/vnd.microsoft.icon
Last-Modified: Thu, 22 Feb 2018 05:17:28 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 4e7ab7d3a1019b0c033068318d72e5ee.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 133
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: SIN2-P4
Server: Apache

GET
H/1.1 200
OK spx Show response
dx.mountain.com/ 23 KB
6 KB 792ms
210ms Script
application/javascript 52.88.179.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=61723050233172104term=value
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.88.179.26 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-88-179-26.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: b0f83ebd635879a4d8d43ad3379b45e32d2d27f541271977ff850a78706fe70b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 2
connection: close
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/javascript;charset=utf-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: istio-envoy

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 182 KB
66 KB 178ms
146ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4NSPPXN

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.136 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

3a08b9098028e5492689bf6443fcef194114b2f20d7ec50c12108ae02cec6a3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
expires: Fri, 20 Sep 2024 13:15:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 67108
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 149ms
44ms Script
application/javascript 151.101.228.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.228.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Fri, 20 Sep 2024 13:15:08 GMT
x-tw-cdn: FT
last-modified: Wed, 27 Mar 2024 23:09:36 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kiad7000135-IAD, cache-hnd18726-HND
x-amz-server-side-encryption: AES256

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1773420&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

43 B
1 KB

128ms
108ms

Image
image/gif

103.43.90.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Protocol

Server

103.43.90.19 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.201.218; 146.70.201.218; 595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 731ea302-28b4-4e63-8ef5-674c07f2d12a
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:08 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 146.70.201.218; 146.70.201.218; 595.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 985c31a0-2825-429a-bc82-2f522c48b53a
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:08 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?add=36113683
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

43 B
1 KB

99ms
77ms

Image
image/gif

103.43.90.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Protocol

Server

103.43.90.53 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

594.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.201.218; 146.70.201.218; 594.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 7649d8bc-dc1a-431f-9153-8523e58f0fe6
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:08 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.201.218; 146.70.201.218; 594.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 9648665d-96cc-4587-80ba-1ee89248cd28
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:08 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 iztag.js Show response
tags.inzynk.io/0ulh3gex/ 34 B
441 B 148ms
36ms Script
application/octet-stream 2600:9000:2751:aa00:12:dfa9:e200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.inzynk.io/0ulh3gex/iztag.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2751:aa00:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding
x-amz-version-id: 15XT7F8rursoJ6jHrhKIXrYdXTZkWasY
etag: "595f7fa79bc22a7029d2751228622eb4"
age: 57784
via: 1.1 7412d2bd99b25704f1e81abd128287b4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 34
x-amz-cf-id: Oea2X_sm4mWOtaOH5w56kDVe1zC-NQlnR9H3zoKnSAhDQhaFJeo9cA==
date: Thu, 19 Sep 2024 21:12:21 GMT
content-type: application/octet-stream
last-modified: Thu, 05 Sep 2024 13:11:02 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P2
x-amz-server-side-encryption: AES256

GET
H2

200

usersync.aspx
dis.criteo.com/dis/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=EFB6A5247DFA4216AC575DEF6DB3FD1E
https://cm.g.doubleclick.net/pixel?google_nid=smaato&gdpr=0&gdpr_consent=&google_hm=4629f255ae&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg%26gdpr%3D0%26gdpr_consent%3D
https://s.ad.smaato.net/c/?adExInit=g&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://dis.criteo.com/dis/usersync.aspx?r=80&p=286&cp=smaato&cu=1&url=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FdspId%3D1001851%26dspCookie%3D%24%7BCRITEO_USERID%7D%26gdpr%3D0%26gdpr_consent%3D,&gdpr...

43 B
363 B

87ms
10ms

Image
image/gif

182.161.74.16
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=80&p=286&cp=smaato&cu=1&url=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FdspId%3D1001851%26dspCookie%3D%24%7BCRITEO_USERID%7D%26gdpr%3D0%26gdpr_consent%3D,&gdpr=0&gdpr_consent=,

Protocol

Server

182.161.74.16 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
pragma: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 317777
expires: Fri, 20 Sep 2024 00:00:00 GMT
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: image/gif
server: Kestrel

Redirect headers

cache-control: max-age=300
location: https://dis.criteo.com/dis/usersync.aspx?r=80&p=286&cp=smaato&cu=1&url=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FdspId%3D1001851%26dspCookie%3D%24%7BCRITEO_USERID%7D%26gdpr%3D0%26gdpr_consent%3D,&gdpr=0&gdpr_consent=,
via: 1.1 9a68aa2295e0518a40c6c84f73c16ab8.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: 51LZkDw-gv5hb0nHgkfPt9se1cyS6H7BdoPAQ4F3vSZ8kwWJJ36Q8A==
date: Fri, 20 Sep 2024 13:15:09 GMT
x-amz-cf-pop: NRT20-P3
server: CloudFront

GET
H2

200

RX-e92ccebb-ff6a-487f-acbc-40f90504edf9-004
sync.targeting.unrulymedia.com/csync/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/EFB6A5247DFA4216AC575DEF6DB3FD1E
https://sync.1rx.io/usersync/simplifi/EFB6A5247DFA4216AC575DEF6DB3FD1E?zcc=1&cb=1726838108984
https://sync.targeting.unrulymedia.com/csync/RX-e92ccebb-ff6a-487f-acbc-40f90504edf9-004

43 B
378 B

272ms
41ms

Image
image/gif

74.118.186.107
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-e92ccebb-ff6a-487f-acbc-40f90504edf9-004
Protocol: H2
Server: 74.118.186.107 Serangoon New Town, Singapore, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Fri, 20 Sep 2024 13:15:09 GMT
content-length: 43

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://sync.targeting.unrulymedia.com/csync/RX-e92ccebb-ff6a-487f-acbc-40f90504edf9-004
date: Fri, 20 Sep 2024 13:15:09 GMT
pragma: no-cache
content-type: text/html

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=EFB6A5247DFA4216AC575DEF6DB3FD1E&dongle=yf3
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=EFB6A5247DFA4216AC575DEF6DB3FD1E&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

37 B
474 B

127ms
94ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=EFB6A5247DFA4216AC575DEF6DB3FD1E&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: /xuid?ld=1&mid=7969&xuid=EFB6A5247DFA4216AC575DEF6DB3FD1E&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 20 Sep 2024 13:15:09 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=EFB6A5247DFA4216AC575DEF6DB3FD1E

43 B
175 B

588ms
166ms

Image
image/gif

2600:1f18:612b:4200:439f:77e3:80bf:81be
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=EFB6A5247DFA4216AC575DEF6DB3FD1E
Protocol: H2
Server: 2600:1f18:612b:4200:439f:77e3:80bf:81be Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://simplifi.partners.tremorhub.com/sync?UISF=EFB6A5247DFA4216AC575DEF6DB3FD1E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:08 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=EFB6A5247DFA4216AC575DEF6DB3FD1E
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=EFB6A5247DFA4216AC575DEF6DB3FD1E

95 B
429 B

61ms
50ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=EFB6A5247DFA4216AC575DEF6DB3FD1E

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=EFB6A5247DFA4216AC575DEF6DB3FD1E
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Fri, 20 Sep 2024 13:15:08 GMT
server: Jetty(11.0.13)

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=EFB6A5247DFA4216AC575DEF6DB3FD1E
https://d.agkn.com/pixel/10751/?che=1726838108896&ip=146.70.201.218&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D232283305011003802890
https://um.simpli.fi/aa_px?sk=232283305011003802890
https://um.simpli.fi/empty.gif

43 B
361 B

113ms
90ms

Image
image/gif

34.126.167.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

34.126.167.117 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

117.167.126.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
location: /empty.gif
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EFB6A5247DFA4216AC575DEF6DB3FD1E
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EFB6A5247DFA4216AC575DEF6DB3FD1E&ckls=true&ci=K0frtNyOzI&nc=false&trid=664204504

43 B
1 KB

220ms
167ms

Image
image/gif

3.164.110.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EFB6A5247DFA4216AC575DEF6DB3FD1E&ckls=true&ci=K0frtNyOzI&nc=false&trid=664204504
Protocol: H2
Server: 3.164.110.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-110-92.nrt12.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 4cf67b58b52960cded2156c06d93de28.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
x-amz-cf-pop: NRT12-P2
x-amz-cf-id: RJl7yMV1EW8OhuruR1ObG2AmtasWcQSDFGtTawYhNOBJY4MX8_eObg==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=EFB6A5247DFA4216AC575DEF6DB3FD1E&ckls=true&ci=K0frtNyOzI&nc=false&trid=664204504
pragma: no-cache
via: 1.1 4cf67b58b52960cded2156c06d93de28.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
x-amz-cf-pop: NRT12-P2
x-amz-cf-id: TUoCAexvZACwVvB5qC_5012CSQZmrcNS5V5NLMfEtLMADwHGWU7z1w==

GET
H2 200 pubmatic
um.simpli.fi/ 43 B
409 B 97ms
73ms Image
image/gif 34.126.167.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.126.167.117 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

117.167.126.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:08 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 freewheel
um.simpli.fi/ 43 B
409 B 98ms
73ms Image
image/gif 34.126.167.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/freewheel

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.126.167.117 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

117.167.126.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:08 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

getuid
sync.smartadserver.com/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=EFB6A5247DFA4216AC575DEF6DB3FD1E;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=EFB6A5247DFA4216AC575DEF6DB3FD1E;mimetype=img;sr
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Ffei.pro-market.net%2Fengine%3Fsite%3D161185%26size%3D1x1%26du%3D36%26csync%3D[sas_uid]
https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1

0
316 B

111ms
107ms

Image
text/plain

23.106.50.38
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
Protocol: HTTP/1.1
Server: 23.106.50.38 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD., SG),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 20 Sep 2024 13:15:09 GMT
pragma: no-cache

Redirect headers

cache-control: no-cache,no-store
location: https://sync.smartadserver.com:443/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 20 Sep 2024 13:15:08 GMT
pragma: no-cache

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=EFB6A5247DFA4216AC575DEF6DB3FD1E&j=0
https://loadm.exelator.com/load/?p=204&g=2191&simid=EFB6A5247DFA4216AC575DEF6DB3FD1E&j=0&xl8blockcheck=1

0
2 KB

458ms
444ms

Image
text/plain

34.229.3.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=EFB6A5247DFA4216AC575DEF6DB3FD1E&j=0&xl8blockcheck=1
Protocol: H2
Server: 34.229.3.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-229-3-43.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 20 Sep 2024 13:15:10 GMT
x-powered-by: Undertow/1
server: nginx
access-control-allow-credentials: true

Redirect headers

cache-control: no-cache
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=EFB6A5247DFA4216AC575DEF6DB3FD1E&j=0&xl8blockcheck=1
access-control-allow-credentials: true
content-length: 0
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
x-powered-by: Undertow/1
server: nginx

GET
H2 200 yahoo
um.simpli.fi/ 43 B
409 B 98ms
74ms Image
image/gif 34.126.167.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/yahoo

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.126.167.117 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

117.167.126.34.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:08 GMT
access-control-allow-origin: *
content-length: 43
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=EFB6A5247DFA4216AC575DEF6DB3FD1E

0
421 B

790ms
181ms

Image
text/plain

52.6.242.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=EFB6A5247DFA4216AC575DEF6DB3FD1E
Protocol: HTTP/1.1
Server: 52.6.242.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-242-65.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Date: Fri, 20 Sep 2024 13:15:09 GMT
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.bfmio.com/sync?pid=141&uid=EFB6A5247DFA4216AC575DEF6DB3FD1E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:08 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=EFB6A5247DFA4216AC575DEF6DB3FD1E

62 B
445 B

250ms
189ms

Image
image/gif

23.44.52.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=EFB6A5247DFA4216AC575DEF6DB3FD1E
Protocol: H2
Server: 23.44.52.187 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-44-52-187.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
content-length: 62
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://stags.bluekai.com/site/29931?id=EFB6A5247DFA4216AC575DEF6DB3FD1E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:08 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

tpid=EFB6A5247DFA4216AC575DEF6DB3FD1E
bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=EFB6A5247DFA4216AC575DEF6DB3FD1E
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=EFB6A5247DFA4216AC575DEF6DB3FD1E

49 B
265 B

119ms
89ms

Image
image/gif

54.251.109.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=EFB6A5247DFA4216AC575DEF6DB3FD1E
Protocol: H2
Server: 54.251.109.127 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-251-109-127.ap-southeast-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
x-server: 10.42.19.129
server: Jetty(9.4.38.v20210224)

Redirect headers

cache-control: no-cache
location: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=EFB6A5247DFA4216AC575DEF6DB3FD1E
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 20 Sep 2024 13:15:09 GMT
x-server: 10.42.19.216
server: Jetty(9.4.38.v20210224)

GET
H2

200

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=EFB6A5247DFA4216AC575DEF6DB3FD1E
https://ce.lijit.com/merge?pid=2&3pid=EFB6A5247DFA4216AC575DEF6DB3FD1E&dnr=1

43 B
512 B

155ms
143ms

Image
image/gif

52.27.42.108
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=EFB6A5247DFA4216AC575DEF6DB3FD1E&dnr=1
Protocol: H2
Server: 52.27.42.108 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-27-42-108.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://ce.lijit.com/merge?pid=2&3pid=EFB6A5247DFA4216AC575DEF6DB3FD1E&dnr=1
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 20 Sep 2024 13:15:09 GMT
vary: Accept-Encoding

GET
H2

200

cm
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=EFB6A5247DFA4216AC575DEF6DB3FD1E
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D

43 B
136 B

90ms
39ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, max-age=0, no-cache
content-encoding: gzip
pragma: no-cache
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 56
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
vary: Accept, Accept-Encoding
server: OXGW/0.0.0

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Fri, 20 Sep 2024 13:15:09 GMT

GET
H3

200

/
www.google.co.jp/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1726838108360&cv=7&fst=1726838108360&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1495905364&cv=7&fst=1726838108360&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLH...
https://www.google.com/pagead/1p-conversion/1026675585/?random=1495905364&cv=7&fst=1726838108360&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHD...
https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=1495905364&cv=7&fst=1726838108360&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCL...

42 B
64 B

71ms
67ms

Image
image/gif

142.250.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=1495905364&cv=7&fst=1726838108360&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7EC&pscrd=IhMIxMK_oM3RiAMV1ojpBR084iYpMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfDRZGiVCUVyDi4r8XMfhdXVB0YfcSJCUC3hVYMPGEL1CZkbr5&random=1393785885&ipr=y

Protocol

Server

142.250.76.131 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix07s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.co.jp/pagead/1p-conversion/1026675585/?random=1495905364&cv=7&fst=1726838108360&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7EC&pscrd=IhMIxMK_oM3RiAMV1ojpBR084iYpMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQDpaXnfDRZGiVCUVyDi4r8XMfhdXVB0YfcSJCUC3hVYMPGEL1CZkbr5&random=1393785885&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 20 Sep 2024 13:15:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 109ms
88ms Image
text/plain 34.126.167.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.126.167.117 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

117.167.126.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:08 GMT
x-content-type-options: nosniff

GET
H2

200

setuid
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=EFB6A5247DFA4216AC575DEF6DB3FD1E

43 B
1 KB

119ms
98ms

Image
image/gif

103.43.90.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=66&code=EFB6A5247DFA4216AC575DEF6DB3FD1E

Protocol

Server

103.43.90.53 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

594.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 146.70.201.218; 146.70.201.218; 594.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: f529c6c1-7f4b-4fb6-b698-d15149173943
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 20 Sep 2024 13:15:08 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ib.adnxs.com/setuid?entity=66&code=EFB6A5247DFA4216AC575DEF6DB3FD1E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:08 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=EFB6A5247DFA4216AC575DEF6DB3FD1E&expires=365

42 B
1 KB

419ms
121ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=EFB6A5247DFA4216AC575DEF6DB3FD1E&expires=365
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6690dc791bf02dde8c4051a04cfd7bb8
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=EFB6A5247DFA4216AC575DEF6DB3FD1E&expires=365
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:08 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=EFB6A5247DFA4216AC575DEF6DB3FD1E

43 B
264 B

107ms
44ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072966&val=EFB6A5247DFA4216AC575DEF6DB3FD1E
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 43
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: image/gif
vary: Accept
server: OXGW/0.0.0

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://us-u.openx.net/w/1.0/sd?id=537072966&val=EFB6A5247DFA4216AC575DEF6DB3FD1E
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 19 Sep 2024 13:15:08 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 20 Sep 2024 13:15:08 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_gid=CAESEM_D5pw2sYTAA1M15IIXuvM&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=EFB6A5247DFA4216AC575DEF6DB3FD1E
https://um.simpli.fi/g_match?id=

0
320 B

84ms
74ms

Image
text/plain

34.126.167.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=

Protocol

Server

34.126.167.117 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

117.167.126.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:15:09 GMT
access-control-allow-origin: *
date: Fri, 20 Sep 2024 13:15:09 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

cache-control: no-cache, must-revalidate
location: https://um.simpli.fi/g_match?id=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 229
date: Fri, 20 Sep 2024 13:15:09 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401 Show response
abm-tracking.demandscience.com/page-tracking/fortinet_2712/ 2 B
665 B 125ms
122ms Script
application/json 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/page-tracking/fortinet_2712/https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?visitorId=d13d32f58501fd8aea71a13fdffce4b8_1726838108540&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 20 Sep 2024 13:15:09 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2

200

threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4963256837942.36
10104846.fls.doubleclick.net/activityi;dc_pre=CJXZuqDN0YgDFdhvDwId03w2zQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/ Frame 9BF7
Redirect Chain

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;d...
https://10104846.fls.doubleclick.net/activityi;dc_pre=CJXZuqDN0YgDFdhvDwId03w2zQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoser...

0
0

79ms
46ms

Document
text/html

172.217.26.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10104846.fls.doubleclick.net/activityi;dc_pre=CJXZuqDN0YgDFdhvDwId03w2zQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4963256837942.36?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.26.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 2223
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:08 GMT
expires: Fri, 20 Sep 2024 13:15:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 20 Sep 2024 13:15:08 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10104846.fls.doubleclick.net/activityi;dc_pre=CJXZuqDN0YgDFdhvDwId03w2zQ;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=4963256837942.36?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
58 KB 60ms
32ms Script
application/x-javascript 157.240.31.5
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.31.5 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-nrt1.fbcdn.net

Software

Resource Hash

0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4454, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: 7IVixk8Bjem/2nMJQXkldCj05Om9EXlPhbM95+iEAAMnsjBU5+CrqfWSVaJFR35B2kcRBnMBtzB/Qg14Sfvk0Q==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 58953
x-xss-protection: 0

GET
H3 200 siteanalyze_6033413.js Show response
siteimproveanalytics.com/js/ 38 KB
12 KB 96ms
60ms Script
application/javascript 172.67.163.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6033413.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.163.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "8451e15415563cef4e816d6dd250d58a"
age: 7139
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DKJZmG6AfbA9aEKWufhunjYe9MIrJt0QMq%2Bk%2BpFEcvYjB71jFmBR3Vf6DskQLtG6EUlvToIYBwgwsG%2BkaGTuog%2FmkyPMsWtltGyAi6xlLNZlX9GES%2Bbj8ebKqr5HPekqHsbjPGmtf%2B%2Fw0cs%3D"}],"group":"cf-nel","max_age":604800}
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 03 Sep 2024 18:55:37 GMT
vary: Accept-Encoding
x-amz-id-2: OAE/Axcr+q8X5g9fv4STEQIRQggrJSzFpKXg0wBZIcb0DDIAxMqoI48gHMPgNoOEjeUB51Y35Sw=
cache-control: max-age=86400, no-transform
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: ATN0M21V1T5P128Q
cf-ray: 8c6215262f56f59b-NRT
accept-ranges: bytes
content-length: 11550
server: cloudflare

GET
H2 200 adsct
t.co/i/ 43 B
632 B 259ms
161ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=a76f231b-d2ec-4aed-99ec-1eedb863b951&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=21bf5806-f5fd-4cdc-aa75-d2cbfdcf64a9&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 483409d03e679c50
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 064f61f8a8dd2e27d0350890221192a6a9639846188356cab7071bd46cf4b44f
cf-cache-status: DYNAMIC
cf-ray: 8c621526ce277343-NRT
x-response-time: 108
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
395 B 238ms
105ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=a76f231b-d2ec-4aed-99ec-1eedb863b951&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=21bf5806-f5fd-4cdc-aa75-d2cbfdcf64a9&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 11967bf17c59435d
cache-control: no-cache, no-store, max-age=0
x-connection-hash: ae5d811775c5bc928edb095dd597452883c8ce314eb5dd9f3ff0f09bdd82686e
x-response-time: 97
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H2 200 adsct
t.co/i/ 43 B
470 B 286ms
278ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=7f876254-ea5d-4e2e-b4a5-7213c3b9c800&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=21bf5806-f5fd-4cdc-aa75-d2cbfdcf64a9&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 72f188af613136c2
cache-control: no-cache, no-store, max-age=0
x-connection-hash: df6759f67af3b39d4472d47b97569b3d9b81c3c61d313830236bee0ebdf2b534
cf-cache-status: DYNAMIC
cf-ray: 8c621526de337343-NRT
x-response-time: 97
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
212 B 208ms
106ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=7f876254-ea5d-4e2e-b4a5-7213c3b9c800&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=21bf5806-f5fd-4cdc-aa75-d2cbfdcf64a9&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 12447b957bbae374
cache-control: no-cache, no-store, max-age=0
x-connection-hash: ae5d811775c5bc928edb095dd597452883c8ce314eb5dd9f3ff0f09bdd82686e
x-response-time: 97
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H2 200 adsct
t.co/i/ 43 B
469 B 170ms
163ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=f44dfbd6-1923-4d77-aa5b-4dad68de2e9b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=21bf5806-f5fd-4cdc-aa75-d2cbfdcf64a9&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 3fe0fe09078a052f
cache-control: no-cache, no-store, max-age=0
x-connection-hash: a96e584485dfe26d4a71228a0e4229af76390a0b2ce0efccef59026e3b3d11c3
cf-cache-status: DYNAMIC
cf-ray: 8c621526de377343-NRT
x-response-time: 102
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_m

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
215 B 182ms
106ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=f44dfbd6-1923-4d77-aa5b-4dad68de2e9b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=21bf5806-f5fd-4cdc-aa75-d2cbfdcf64a9&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 0de9a633c6ab2519
cache-control: no-cache, no-store, max-age=0
x-connection-hash: ae5d811775c5bc928edb095dd597452883c8ce314eb5dd9f3ff0f09bdd82686e
x-response-time: 98
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_m

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 215ms
156ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A08%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A07%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%226964%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:09 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK tracking Show response
tracking.contanuity.com/ 2 B
769 B 437ms
134ms Script
application/json 54.203.236.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.contanuity.com/tracking?visitorId=d13d32f58501fd8aea71a13fdffce4b8_1726838108540&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.203.236.163 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-203-236-163.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 20 Sep 2024 13:15:09 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 401 / Show response
webtracker.argusplatform.com/wh/track/ 205 B
468 B 1086ms
926ms XHR
application/json 2620:1ec:bdf::46
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838108179686794&event_type=page_request&timestamp=1726838109&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:bdf::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20240920T131509Z-r1677749c86ct2h9ph7z50f4t00000000bw000000000mz22

GET
H2 200 tag.aspx Show response
ml314.com/ 38 KB
13 KB 108ms
24ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?208
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
content-encoding: br
age: 256
x-goog-stored-content-encoding: identity
x-cache-hit: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39162
date: Fri, 20 Sep 2024 13:10:53 GMT
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
content-type: application/javascript
vary: Accept-Encoding
x-guploader-uploadid: AD-8ljuMOIQtzF7pR7QW9168kCuY6bPc2J5rHzk3R6Pmc0ub7VpnFnU2YTaDWY_l4lA6kdezWp2OiGPF7w
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
cache-id: NRT
accept-ranges: bytes
x-goog-generation: 1721849450340665
content-length: 12522
server: UploadServer

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 47ms
5ms Script
application/javascript 2600:140b:1a00:4::17c1:b89e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:140b:1a00:4::17c1:b89e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=61966
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Fri, 20 Sep 2024 13:15:09 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK is Show response
35.160.46.251/ 32 B
437 B 682ms
163ms Fetch
text/plain 35.160.46.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://35.160.46.251/is
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=61723050233172104term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.160.46.251 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-160-46-251.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 7398e1925f57dbcd83bdf384077c1f8d010ad1e70c0b31f2a10f7a0c190d851a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 2
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
content-length: 32
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: text/plain;charset=utf-8
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 image.aspx
6033413.global.siteimproveanalytics.io/ 34 B
149 B 396ms
97ms Image
image/gif 54.183.57.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6033413.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&res=1600x1200&accountid=6033413&rt=11998&prev=9144ad26-52de-87f7-aad8-42dc2fd6e6f7&luid=0fd5b43b-b188-4735-3ed8-f550a5630d86&rnd=84432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.183.57.53 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-183-57-53.us-west-1.compute.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: Fri, 20 Sep 2024 13:15:09 UTC
cache-control: max-age=0
content-length: 34
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif

POST
H2 201 v11 Show response
tracking.crazyegg.com/ 0
82 B 134ms
98ms XHR
text/plain 43.201.174.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/v11?u=1170786&st=424000&s=6037001&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/db7349b994413162218df5c920535415.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.201.174.92 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-43-201-174-92.ap-northeast-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/gzip
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: text/plain
server: awselb/2.0

GET
H3 200 177020962864941 Show response
connect.facebook.net/signals/config/ 66 KB
13 KB 19ms
10ms Script
application/x-javascript 157.240.31.5
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.167&r=stable&domain=www.fortinet.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.31.5 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-nrt1.fbcdn.net

Software

Resource Hash

6c96e2d7e3d052c2c4fc96b42a991077b82cc1118c272a97b8c2880a1ebd9357

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=74, mss=1232, tbw=67094, tp=62, tpl=0, uplat=2, ullat=-1
pragma: public
x-fb-debug: otLb2u21ERHfiRWAJFMsSKRdLe5Oy+3l0ZSRU4IMTexSO+fw9kqCbg0vUvSIwDHuQwlNZ1nXo4o77JYk9UGLew==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 13328
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
977 B 243ms
202ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=7120%2C2159050%2C4628290&time=1726838109562&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
x-li-fabric: prod-lva1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
access-control-allow-methods: GET, OPTIONS
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/json
access-control-allow-headers: *
x-li-pop: afd-prod-lva1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-fs-uuid: 0006228cd41ccc3afe792e7ee7d38668
x-msedge-ref: Ref A: 18B2E120BF114CD3AF782F8E48E9C310 Ref B: TYO01EDGE0813 Ref C: 2024-09-20T13:15:09Z
x-restli-protocol-version: 1.0.0
x-li-uuid: AAYijNQczDr+eS5+59OGaA==
access-control-allow-origin: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838109562&li_adsId=7bf4f8b1-e549-4e8f-8afa-55245d244317&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-resea...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838109562&li_adsId=7bf4f8b1-e549-4e8f-8afa-55245d244317&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-rese...

0
486 B

245ms
192ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838109562&li_adsId=7bf4f8b1-e549-4e8f-8afa-55245d244317&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&e_ipv6=AQLjWjGDw7OURwAAAZIPknX-F0Ya2srLwnP-SCY0FeBw5FEWSc3Crlr5Fvt8l4FzXJ8Jaw
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: C355FF30FAC84556BC8804D929555E0E Ref B: TYAEDGE0807 Ref C: 2024-09-20T13:15:09Z
x-li-fabric: prod-lva1
x-li-uuid: AAYijNQgoTts87CUbCivHA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290&time=1726838109562&li_adsId=7bf4f8b1-e549-4e8f-8afa-55245d244317&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&e_ipv6=AQLjWjGDw7OURwAAAZIPknX-F0Ya2srLwnP-SCY0FeBw5FEWSc3Crlr5Fvt8l4FzXJ8Jaw
x-msedge-ref: Ref A: 75B6A773695C481DAABF6CA9BA399C95 Ref B: TYAEDGE1010 Ref C: 2024-09-20T13:15:09Z
x-li-fabric: prod-lva1
x-li-uuid: AAYijNQcyYbu7g6ISmsbog==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 20 Sep 2024 13:15:09 GMT

GET
H2 200 utsync.ashx Show response
ml314.com/ 575 B
1 KB 52ms
38ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pv=1726838109600_qq2qayhtm&bl=ja-jp&cb=5440613&return=&ht=&d=&dc=&si=1726838109600_qq2qayhtm&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?208
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 29af3002eb8a7685cfc6a2c81f99ac0058c2f9975996d21a0e696e4c1f8e7bfa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: application/javascript
server: Google Frontend

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 85ms
16ms Image
text/plain 2a03:2880:f10f:187:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&rl=&if=false&ts=1726838109637&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726838109629.453275858453947151&ler=empty&cdl=API_unavailable&it=1726838109553&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f10f:187:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=10, mss=1368, tbw=2806, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 231ms
151ms Image
image/png 2a03:2880:f10f:187:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&rl=&if=false&ts=1726838109637&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726838109629.453275858453947151&ler=empty&cdl=API_unavailable&it=1726838109553&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f10f:187:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7416713205685058728"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x1df81ccff3911cb6","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"2":["24:1473595392721544","7830:1473595392721544","10853:1473595392721544","41:1473595392721544","8046:1473595392721544"]},"debug_reporting":true,"debug_key":"3236972021248727113"}
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: mQlBVJ9kYM4uZdpw5k4QM1wff1YjFy64rLia4QTWKg1LupbjRb5PYO2AiPNC3Fpz7cUHpL/aMxdUYmDVUKjXKA==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7416713205685058728", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=10, mss=1368, tbw=3123, tp=-1, tpl=-1, uplat=158, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 ibs:dpid=22052&dpuuid=3647144415818416199&redir=
dpm.demdex.net/ 42 B
717 B 68ms
28ms Image
image/gif 3.112.147.252
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3647144415818416199&redir=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.112.147.252 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-112-147-252.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-tyo3-1-v062-0d937dcc9.edge-tyo3.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: Nt89JYyyQYw=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif

GET
H3

200

utsync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&gdpr=0&gdpr_consent=

43 B
61 B

52ms
45ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0,Sat, 21 Sep 2024 13:15:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

location: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&gdpr=0&gdpr_consent=
content-length: 241
date: Fri, 20 Sep 2024 13:15:09 GMT
server: Kestrel

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3647144415818416199
https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144415818416199

43 B
56 B

55ms
50ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144415818416199
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Sat, 21 Sep 2024 13:15:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-cache
location: https://ml314.com/csync.ashx?fp=fca625e3820052c393bd7456ec9537ce&eid=50146&person_id=3647144415818416199
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 20 Sep 2024 13:15:09 GMT
x-server: 10.42.7.163
server: Jetty(9.4.38.v20210224)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2r5Ut5E2THlV76arILluoSGyuI94VbXoaMOJixj48dEg&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

70 B
440 B

79ms
76ms

Image
image/gif

18.182.162.20
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Protocol: HTTP/1.1
Server: 18.182.162.20 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-182-162-20.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 20 Sep 2024 13:15:09 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
pragma: no-cache
via: 1.1 google
expires: 0,Sat, 21 Sep 2024 13:15:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
content-length: 43
date: Fri, 20 Sep 2024 13:15:09 GMT
content-type: image/gif
x-cloud-trace-context: 119ffd5843b40af5f4724c664db5c51e
server: Google Frontend

GET

usersync
tracking.contanuity.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838108540
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=d13d32f58501fd8aea71a13fdffce4b8_1726838108540&_bee_ppp=1
https://tracking.contanuity.com/usersync?bwcookie=AAF-wU7N2usAABTSuUdfPQ

0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 187ms
171ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A09%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A08%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%227964%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:10 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 2 KB
1 KB 532ms
121ms Script
application/javascript 52.89.99.220
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=2121178243.1726838107&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%222121178243.1726838107%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838106.1%22%2C%22mntnis%22%3A%22hGfblJFqVdMinItclMK1%2FQGwtDEIRnmt%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A7%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838106.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838106%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838107%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=61723050233172104term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=61723050233172104term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.89.99.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-89-99-220.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 4b2f0e0711acd760eb646295c4165bb0122ea7951beb3c5ac0ff053171e3dfab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 1
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:10 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
194 B 200ms
175ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 7A33642ABD1B45C18AD77E0054E03314 Ref B: TYAEDGE1010 Ref C: 2024-09-20T13:15:10Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYijNQj5glY4efbWJsN1Q==
x-li-proto: http/2
access-control-allow-origin: https://www.fortinet.com
x-cache: CONFIG_NOCACHE
date: Fri, 20 Sep 2024 13:15:10 GMT
vary: Origin

GET
H/1.1 200
OK gs Show response
gs.mountain.com/ 144 B
735 B 739ms
327ms Script
application/javascript 35.81.162.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gs.mountain.com/gs
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=2121178243.1726838107&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%222121178243.1726838107%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838106.1%22%2C%22mntnis%22%3A%22hGfblJFqVdMinItclMK1%2FQGwtDEIRnmt%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A7%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838106.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838106%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838107%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=61723050233172104term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.81.162.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-81-162-201.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: c93daa60f006a86838fbbb7bae3dde20014d13e56f19d6c15099ca00657d572c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 191
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:11 GMT
content-length: 144
content-type: application/javascript;charset=utf-8
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 204ms
204ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A10%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A09%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%228966%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:11 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 5 KB
2 KB 598ms
208ms Script
application/javascript 52.89.99.220
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=2121178243.1726838107&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%222121178243.1726838107%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838106.1%22%2C%22mntnis%22%3A%22hGfblJFqVdMinItclMK1%2FQGwtDEIRnmt%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A7%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838106.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838106%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838107%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue&cb=1726838110492104&shguid=a2bf8823-a350-3f04-8327-6ff348bacf2f&shgts=1726838111225
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=2121178243.1726838107&shpt=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%222121178243.1726838107%22%2C%22shpt%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221726838106.1%22%2C%22mntnis%22%3A%22hGfblJFqVdMinItclMK1%2FQGwtDEIRnmt%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A7%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1726838106.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221726838106%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221726838107%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&cb=61723050233172104term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.89.99.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-89-99-220.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: c8bd087cae26989a1701124643c9a37dded01b67d7f0943c75941dd6323664fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 38
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 20 Sep 2024 13:15:11 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H/1.1

200
OK

tdsync
px.steelhousemedia.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=5d1c16bc-7752-11ef-a262-b14d38c6f294&gdpr=&gdpr_consent=
https://px.steelhousemedia.com/tdsync?tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&shguid=5d1c16bc-7752-11ef-a262-b14d38c6f294

0
319 B

558ms
158ms

Image
text/plain

52.10.121.135
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.steelhousemedia.com/tdsync?tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&shguid=5d1c16bc-7752-11ef-a262-b14d38c6f294
Protocol: HTTP/1.1
Server: 52.10.121.135 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-10-121-135.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 35
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Fri, 20 Sep 2024 13:15:12 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

Redirect headers

location: https://px.steelhousemedia.com/tdsync?tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&shguid=5d1c16bc-7752-11ef-a262-b14d38c6f294
content-length: 277
date: Fri, 20 Sep 2024 13:15:11 GMT
server: Kestrel

GET

v2
usermatch.krxd.net/um/
Redirect Chain

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3
https://dpm.demdex.net/ibs:dpid=903&dpuuid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://tags.bluekai.com/site/5386?id=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NDU1NjQ4ZTAtMzA1Yi00ZDljLWE0OWYtYmNkMmZlMzliMmI2&gdpr=0&gdpr_consent=&ttd_tdid=455648e0-305b-4d9c-a49f-bcd2f...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6&google_gid=CAESEJmdV3Vq4puV0O3AKTck2ek&google_cver=1
https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6

0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 188ms
187ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A10%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%229967%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:12 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:12 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 162ms
161ms Image
image/gif 23.50.118.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=e14c72f7-867f-4de8-8466-56e3df4a5003&session=4c08bc10-923c-4db7-80f9-3898acdfd5a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2020%20Sep%202024%2013%3A15%3A11%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%2210967%22%7D&isIframe=false&m=%7B%22description%22%3A%22When%20the%20GeoServer%20vulnerability%20CVE-2024-36401%20emerged%2C%20the%20FortiGuard%20Labs%20gathered%20related%20intelligence.%20This%20blog%20highlights%20the%20threat%20actors%20and%20how%20they%20exploit%20and%20use%20the%20vulnerability.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CCara%20Lin%22%2C%22title%22%3A%22Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&pageViewId=f252fc57-59e4-455c-8f93-6460a72df8e3&ipv6=2001%3Aac8%3A40%3A1e%3A%3A2e&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.161 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-50-118-161.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 20 Sep 2024 13:15:13 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 20 Sep 2024 13:15:13 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.fortinet.com
URL: blob:https://www.fortinet.com/31169441-3563-48c3-8597-515718712000

Domain: ad.doubleclick.net
URL: https://ad.doubleclick.net/activity;register_conversion=1;src=10050195;npa=0;auiddc=1538869018.1726838104;ps=1;pcor=323568843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401?

Domain: tracking.contanuity.com
URL: https://tracking.contanuity.com/usersync?bwcookie=AAF-wU7N2usAABTSuUdfPQ

Domain: usermatch.krxd.net
URL: https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6

Verdicts & Comments Add Verdict or Comment

162 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

111 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-21 08:26:14	Name: cookiesession1 Value: 678A3E23A0553B59149B24A43E754FAF
.fortinet.com/	1970-01-21 08:26:14	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Fri+Sep+20+2024+22%3A15%3A00+GMT%2B0900+(%E6%97%A5%E6%9C%AC%E6%A8%99%E6%BA%96%E6%99%82)&version=6.10.0&hosts=&consentId=5a190996-a281-412d-b246-1acfc72a733e&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.fortinet.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-21 03:59:50	Name: demdex Value: 30541821646655490073624486381940051027
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
.fortinet.com/	1970-01-21 09:16:38	Name: mbox Value: session#72023157eef2440cbdd770195ed046d6#1726839961\|PC#72023157eef2440cbdd770195ed046d6.32_0#1790082901
.fortinet.com/	1970-01-20 23:40:39	Name: mboxEdgeCluster Value: 32
.dpm.demdex.net/	1970-01-21 03:59:50	Name: dpm Value: 30541821646655490073624486381940051027
.fortinet.com/	1970-01-21 09:16:38	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 179643557%7CMCIDTS%7C19987%7CMCMID%7C30907364271788772553659985250725211611%7CMCAAMLH-1727442900%7C11%7CMCAAMB-1727442900%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1726845300s%7CNONE%7CMCSYNCSOP%7C411-19994%7CvVersion%7C5.5.0
www.fortinet.com/	1970-01-21 09:16:38	Name: _gd_visitor Value: e14c72f7-867f-4de8-8466-56e3df4a5003
www.fortinet.com/	1970-01-20 23:40:52	Name: _gd_session Value: 4c08bc10-923c-4db7-80f9-3898acdfd5a2
.simpli.fi/	1970-01-21 08:27:40	Name: suid Value: EFB6A5247DFA4216AC575DEF6DB3FD1E
www.fortinet.com/	1970-01-20 23:40:38	Name: dicbo_id Value: %7B%22dicbo_fetch%22%3A1726838103351%7D
.fortinet.com/	1970-01-21 01:50:14	Name: _gcl_au Value: 1.1.1538869018.1726838104
.fortinet.com/	1970-01-20 23:40:39	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401
.fortinet.com/	1970-01-21 01:50:14	Name: s_getNewRepeat Value: 1726838103573-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.fortinet.com/	1970-01-20 23:42:04	Name: _uetsid Value: 59bfa690775211efb7958bbdf451304c
.fortinet.com/	1970-01-21 09:02:14	Name: _uetvid Value: 59bfaa00775211ef9c3141fe83c3acaa
.bing.com/	1970-01-21 09:02:14	Name: MUID Value: 0CC1C23C49C26ED92EA0D73C48E06F00
.bat.bing.com/	1970-01-20 23:50:42	Name: MR Value: 0
.fortinet.com/	1969-12-31 23:59:59	Name: _ce.irv Value: new
.fortinet.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.fortinet.com/	1970-01-20 23:42:04	Name: _ce.clock_event Value: 1
.doubleclick.net/	1970-01-21 03:59:50	Name: receive-cookie-deprecation Value: 1
.fortinet.com/	1970-01-21 09:16:38	Name: _ga_38BQ9XFDT4 Value: GS1.1.1726838106.1.0.1726838106.0.0.0
.fortinet.com/	1970-01-21 09:16:38	Name: _ga Value: GA1.1.2121178243.1726838107
.fortinet.com/	1970-01-20 23:42:04	Name: _ce.clock_data Value: 293%2C146.70.201.218%2C1%2Ccd70ceeb4a1768030b1882c90242a428%2CChrome%2CJP
.fortinet.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.fortinet.com/	1970-01-21 08:26:14	Name: _ce.s Value: v~ce73ca188bf32924b31ba131f39a1c4fea46b686~lcw~1726838106927~lva~1726838106253~vpv~0~v11.cs~424000~v11.s~5afc1bf0-7752-11ef-9d3e-95a3cff65b98~lcw~1726838106929
.doubleclick.net/	1970-01-21 09:16:38	Name: IDE Value: AHWqTUl6hu6TVK62brmNTvGxlN8mcVzPfvzCCgFWO-t7C6JKsWcPdPg7gWkq3kFE
www.fortinet.com/	1970-01-21 09:16:38	Name: _omappvp Value: Ex2EXLnxGizXnSpbe0N8eiyznxTB4rGMKLfb6nwbpO7H3Cl1dHHSUbC95xlyO9x3RpfGlNRpLnvnVMCnzeErdMqbR37hsEHN
www.fortinet.com/	1970-01-20 23:40:39	Name: _omappvs Value: 1726838107221
.techtarget.com/	1970-01-20 23:40:39	Name: __cf_bm Value: nvBvqCDh3Z7xZbaTAznfY3simVwJEcPVD9ZwtrUo8dg-1726838107-1.0.1.1-XOuXWnwwCA5sh5agy2mx0sKs73a994Ix4R0ezybaB_tu2w.gDRSoc2yiwYznWO7E6TW85sQKwdPzwXKO83rQvQ
.www.fortinet.com/	1970-01-21 08:26:14	Name: WID_VISITOR_ID Value: 1726838108179686794
.fortinet.com/	1970-01-21 09:16:38	Name: _ga_JH142QCQCJ Value: GS1.1.1726838107.1.0.1726838107.0.0.0
.simpli.fi/	1970-01-20 23:50:42	Name: uid_syncd_secure Value: true
www.fortinet.com/	1970-01-20 23:50:42	Name: AWSALB Value: eamFinF8sySoPW5USCbVGU7ctz+rj7GDtgpcrxlRKdCjV/9mYSsoB//vkp5fZeAdRHnZKtWCNJmvFVEl8vwPM6dBreRSUOb0upHuSCFN2QsWIi6mzA/T6NIV9xxM8OG8SGrKPxAQkptjjhANJCueEamRkakO7pA5cFEHvVPjOcX9za2f0eNWogwqIhEa++U82xabWo4BOU0cWnyU/NjbdIkMYvcs/Yql
www.fortinet.com/	1970-01-20 23:50:42	Name: AWSALBCORS Value: eI2dP7u0pHbaIP7iCfLyqlO7aPp78nb5HanDD0C4HjwYCv5825Z7Hh7qVN+gpaUKBTpA+zQ3Xgey+Mrrl2ITbag1KmVoaUcu25z8ZGBy59dB6T25Drs9DooWH6qnlJFqhNuynFNfzrAENqf7eh1V3bc1P1DnfBkYIsXT/+6wgLwqGmhaQh5h/OK5SdkDCwYobMU1FlL94iA3SYaxScMB9cCqs75e0ijS
.adnxs.com/	1970-01-21 09:16:38	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 01:50:14	Name: XANDR_PANID Value: UHg50t3gnrAV6Ixy-3szlDx3q1wncG_YxEZscb9B4fNjSb-kZDZyT56Dt1etW48Sz9Ts_Z3T_Phsr_aAcIyYHr-P4eRcC0bQ0wl24Hf4aQc.
.adnxs.com/	1970-01-21 01:50:14	Name: uuid2 Value: 1537728222125208909
.agkn.com/	1970-01-21 08:26:14	Name: ab Value: 0001%3AXqLVMNXScEc7sWNw7KooLOP0kXKq8uOH
.smaato.net/	1970-01-21 00:10:52	Name: SCM Value: 4629f255ae
.smaato.net/	1970-01-21 00:10:52	Name: SCMg Value: 4629f255ae
.smaato.net/	1970-01-21 00:10:52	Name: SCM1001136 Value: 4629f255ae
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_TS Value: 1726838108915
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_DID Value: 1d125313-46fd-44dc-a326-6fdf66c33d2d
.agkn.com/	1970-01-21 08:26:14	Name: u Value: C\|0AAAAAAAALoAx3AAAAAAA
.doubleclick.net/	1970-01-21 00:23:50	Name: ar_debug Value: 1
.adnxs.com/	1970-01-21 01:50:14	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2GVJqOe]Z!]tbPl1N!7OnM$=BX3)fnw2cfQhqUh0fNRi-3sojH2UrjbqA[fp7p[hwO$P]313/X%W#.wL4W1Qw2OSZWn<
.tapad.com/	1970-01-21 01:07:02	Name: TapAd_3WAY_SYNCS Value:
.1rx.io/	1970-01-21 08:26:14	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-e92ccebb-ff6a-487f-acbc-40f90504edf9-004%22%7D
abm-tracking.demandscience.com/	1970-01-21 09:16:38	Name: userId Value: d13d32f58501fd8aea71a13fdffce4b8_1726838108540
.3lift.com/	1970-01-21 01:50:14	Name: tluidp Value: 2566307596664500716108
.3lift.com/	1970-01-21 01:50:14	Name: tluid Value: 2566307596664500716108
.linkedin.com/	1970-01-21 01:50:14	Name: li_sugr Value: 3d5140b3-b311-44e3-ad00-7409f57570b8
.linkedin.com/	1970-01-21 08:26:14	Name: bcookie Value: "v=2&02e55a54-5653-453e-8c74-ca3c4697ae2e"
.linkedin.com/	1970-01-20 23:42:04	Name: lidc Value: "b=VGST04:s=V:r=V:a=V:p=V:g=3349:u=1:x=1:i=1726838109:t=1726924509:v=2:sig=AQFWItxN-oGUiWnl1lCkkYq-wZpITS1g"
.intentiq.com/	1970-01-21 09:16:38	Name: IQver Value: 1.9
.intentiq.com/	1970-01-21 09:16:38	Name: intentIQ Value: K0frtNyOzI
.rlcdn.com/	1970-01-21 01:07:02	Name: pxrc Value: CN3qtbcGEgYIuOsBEAA=
.bluekai.com/	1970-01-21 04:01:16	Name: bku Value: blx99aNNfVRoLEWB
.crwdcntrl.net/	1969-12-31 23:59:59	Name: _cc_cc Value: ctst
www.fortinet.com/	1970-01-20 23:42:06	Name: aa_cc Value: RO
www.fortinet.com/	1970-01-20 23:42:06	Name: aa_cn Value: Romania
www.fortinet.com/	1970-01-20 23:42:06	Name: 6scexist Value: true
.rubiconproject.com/	1970-01-21 08:26:14	Name: khaos Value: M1AQTOO9-1E-K0WP
.rubiconproject.com/	1970-01-21 08:26:14	Name: khaos_p Value: M1AQTOO9-1E-K0WP
.rubiconproject.com/	1970-01-21 01:50:14	Name: receive-cookie-deprecation Value: 1
.pro-market.net/	1970-01-21 03:59:50	Name: anProfile Value: "-1no8cczh8gamu+1+1f=1+1g=1+1j=12+rs=s+rt=20010AC80040001E000000000000002E+s2=(sk44t9)+vm=24-EFB6A5247DFA4216AC575DEF6DB3FD1E"
.pro-market.net/	1970-01-21 00:23:50	Name: anHistory Value: "-1no8cczh8gamu+2+!#6wM$z!T+g"
.fortinet.com/	1970-01-21 09:16:38	Name: nmstat Value: 9144ad26-52de-87f7-aad8-42dc2fd6e6f7
.linkedin.com/	1970-01-21 00:23:50	Name: UserMatchHistory Value: AQJD6HeWQHvRLwAAAZIPknRXATCtyiPI5qpYZDBeuUnhf6gFm_JHlDX-0Byfkefgm4VM_mJgHcuxNw
.linkedin.com/	1970-01-21 00:23:50	Name: AnalyticsSyncHistory Value: AQK3g6DIWC3s3AAAAZIPknRXc8XTnUuaECeMGsJTcSAUPbm5yyosnDYj8MfuIkWEx5Xr_rbLuTbmOwj8zgABkQ
.intentiq.com/	1970-01-21 09:16:38	Name: CSDT Value: UEQ6MTAwNDNfMCZVT3Y2aXV3
.intentiq.com/	1970-01-21 09:16:38	Name: IQPData Value: 2454112730#1726838109272#0#1726838109272
.intentiq.com/	1970-01-21 09:16:38	Name: intentIQCDate Value: 1726838109273
.intentiq.com/	1970-01-21 09:16:38	Name: ASDT Value: 0
.targeting.unrulymedia.com/	1970-01-21 08:26:14	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-e92ccebb-ff6a-487f-acbc-40f90504edf9-004%22%7D
.lijit.com/	1970-01-21 08:26:14	Name: ljt_reader Value: JXQbAQZHxo8NXeTDTM6BWfIM
.twitter.com/	1970-01-21 09:16:38	Name: personalization_id Value: "v1_h8w+Si55HmDnzJNrvBY29g=="
.t.co/	1970-01-21 09:16:38	Name: muc_ads Value: 18d4c865-4134-4000-ae60-72def5aeccf2
.t.co/	1970-01-20 23:40:39	Name: __cf_bm Value: FHqRtGL6tq9FCxH3o_lcgOMNsY8bQfYfNXMcv5EPPEU-1726838109-1.0.1.1-hv9AfjGWr3z103LgSOTDfaD_s0syuuvFUF5cwu1pfpD7x0Bm9TCx_V0_GgBLFI9q0FZtGy6iP6kIK4csleF5Ew
.lijit.com/	1970-01-21 08:26:14	Name: _ljtrtb_2 Value: EFB6A5247DFA4216AC575DEF6DB3FD1E
.www.linkedin.com/	1970-01-21 08:26:14	Name: bscookie Value: "v=1&2024092013150960c4d4f3-1847-416e-8f33-aed03903f940AQE8-6KHh5_KWFkNMIh7tImSu782Ykac"
.smartadserver.com/	1970-01-21 08:26:14	Name: TestIfCookieP Value: ok
.smartadserver.com/	1970-01-21 08:26:14	Name: pbw Value: %24b%3d16999%3b%24o%3d99999
.fortinet.com/	1970-01-21 01:50:14	Name: _fbp Value: fb.1.1726838109629.453275858453947151
.ml314.com/	1970-01-21 08:26:14	Name: pi Value: 3647144415818416199
.ml314.com/	1970-01-21 00:00:47	Name: tp Value: 3%253B09%252F20%252F2024%2B13%253A15%253A09%253B0
.bfmio.com/	1970-01-21 08:26:14	Name: __141_cid Value: EFB6A5247DFA4216AC575DEF6DB3FD1E
.bfmio.com/	1970-01-21 08:26:14	Name: __io_cid Value: 64a29d4e2c88d4de4baab5ecb70aa35caef5b32f
.adsrvr.org/	1970-01-21 08:26:14	Name: TDID Value: 455648e0-305b-4d9c-a49f-bcd2fe39b2b6
.eyeota.net/	1970-01-21 08:26:14	Name: mako_uid Value: 1920f92762f-47950000010e52f0
.eyeota.net/	1970-01-20 23:40:38	Name: SERVERID Value: 21232~DM
.smartadserver.com/	1970-01-21 08:26:14	Name: pid Value: 7406090792376507269
.exelator.com/	1970-01-21 02:33:26	Name: EE Value: "ff0ddbb1712f65bb05c3414c7115115e"
tracking.contanuity.com/	1970-01-21 09:16:38	Name: userId Value: d13d32f58501fd8aea71a13fdffce4b8_1726838108540
tracking.contanuity.com/	1970-01-21 09:16:38	Name: clientId Value: undefined
.ml314.com/	1970-01-20 23:40:38	Name: u Value: aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLw%3D%3D
.bidr.io/	1970-01-21 09:09:11	Name: bito Value: AAF-wU7N2usAABTSuUdfPQ
.bidr.io/	1970-01-21 09:09:11	Name: bitoIsSecure Value: ok
.exelator.com/	1970-01-21 02:33:26	Name: udo Value: "gAAAAAQAAAUlKLUv%252FWAlBI0aAPZtqUggi1gHABgCMMS0sH8CsELAX3y3w34Lo2UgnGronWfuTzPy7T4XhT5pSJ9%252FD3DvCvA6RqOU1OLqiyBsEdVSyTg1OtsxyMHpjBSVAJQAkgBbDJV9d6HH9lKybNMyJeUmv4%252F30gOmpFBr2ikheddeh1uoiXVLnUmoE3r01zWowzCRIw6N5QfET7ZMJldknObq6JLk4gYNRvx9eNdDZdh1vsEOoxx4EepJTZHEUjDK%252BqdQvYcDEgBUqTz3MOL%252FJb6lpaXlC%252Fw%252FAAXPIgKjLJEj%252FkhdliRDBAwCMEj8g3hPsQEXhVkWAv1MUbDWCNmFGuaiJ1RrYkcY1VzZ10XFDinnaopOk3VFr3J%252FXlkHF30jsC7nleV8kbnYaFzWcILdNmSEajVYbY93Xe9Ro7hO0Fc1SSUl5%252FCxk%252BGJ6r4YtGVdFIrhNs2EAo78Za6xN3IHod1Buhqsxh2Oo05NCWtaosFc49DIwV3qjgMiYTvs4Lwz8UI4pWVPIS%252FqtQIqKu2KgraaoAppr3fKsoObhKk6Oih2j06LwItI9ThnmYaRMdEe7yJrFjnTLDLOYrNlDqQYdgd67PBLJEMtxx8egntENTlrcuZGW94yI00mEmk2JC1zWSQ6z4xEwjyLF4JYGFpmjdvD9bGmp5cthR7wUdzZ%252BzIcb%252FNtT8NpOr3J2qY%252Fj9s0jd5wvo15Fs9HbplGBn9h4l%252FlQWxcNi4fLh%252Fi%252FGhZsdaUslTtKI6RSCJW7H1PVmaiQsX%252FI6D4AS%252FxEhMVPkPLeaNxijJyVno1SBkMnkVlTxds5IVhkWlAWGCCJBA5KkwQDuBHd7oGtUqnlTXBYiGlt0QSI71w47IiYnru69K4bUNyoaYqRNTUPF%252BqVuxdTVTtVDMdoe17MvIJOZ13sP8LEysfq43LyrkKQiBAAkKQQ2Ye9IWzmOT8FRbIJHWVJC2HOgnBZ3co8Hly1jzEsgUGqI3DMSn69UgkXRPhmABNbOFscU%252Bxhcyu3Qd1WlQQXwNmD7UluONjg4kRwQmgg1zwCybJ0sV7QS78LH2D1AlvUUb8Loqsc9CauLBeNg9s9XgVA9OUBSozc9%252FCHAjHOB8MvqTlqVTC3%252Fs1bmcC12oFp7XpuxEEWH1oDDMoy9je78MlAw%253D%253D"
.exelator.com/	1970-01-21 02:33:26	Name: ud Value: "eJxrXxzq6XKLQSEtzSAlJSnJ0NzQKM3MNCnJwDTZ2MTQJNnc0NAUiFIXl6UWLVhaWpyaknRoSUVOSU7T6rL4UMd4N0dfT5%252FIZc4ZRfm5qSvAQmGuQYsNjSyX5Bdlpi%252FyClhclJLGsKik%252BFTwSfaTAKU5Kiw%253D"
.mountain.com/	1970-01-21 08:26:14	Name: guid Value: 5d1c16bc-7752-11ef-a262-b14d38c6f294
.px.mountain.com/	1970-01-21 08:26:14	Name: tt Value: "H4sIAAAAAAAAAKtW8guKNzYyNjaLNzK3NFayMtBRgnItjC2UrAzNjcyADENDQ3Mzcx2lMiUrIx0kLWA1BrUAkNByAkYAAAA="
.mountain.com/	1970-01-21 08:26:14	Name: rt Value: "MzIzMzY6MTcyNjgzODExMQ=="
.rubiconproject.com/	1970-01-21 08:26:14	Name: audit_p Value: 1\|4NNqqTdl0PvrsKazBRR7t9oyzuaXAZk0PZ6rBymkwsrULEzLSiMGrcswWbWpevLYDdmOwfLK2k0wHTRO1/p4iGfsp8ABdinMMf+s+oisr/6I4vJjf0BVXmu/etDXtYyZB1KWnLHuMT4jABPGIRApQLwONCRRMckDdeodiyl5GGjz2vDHqR/c6KfkLNxlFhbb
.rubiconproject.com/	1970-01-21 08:26:14	Name: audit Value: 1\|4NNqqTdl0PvrsKazBRR7t9oyzuaXAZk0PZ6rBymkwsrULEzLSiMGrcswWbWpevLYDdmOwfLK2k0wHTRO1/p4iGfsp8ABdinMMf+s+oisr/6I4vJjf0BVXmu/etDXtYyZB1KWnLHuMT4jABPGIRApQLwONCRRMckDdeodiyl5GGjz2vDHqR/c6KfkLNxlFhbb
.adsrvr.org/	1970-01-21 08:26:14	Name: TDCPM Value: CAESFgoHZDB0cm8xahILCLyi95KJ4Kw9EAUSEgoDYWFtEgsImrm5x8-toT0QBRIWCgdibHVla2FpEgsIlM6hp4ngrD0QBRIWCgdydWJpY29uEgsIlsLYqIngrD0QBRIVCgZnb29nbGUSCwiQ_fqpieCsPRAFEhMKBGtydXgSCwjMuqXKz62hPRAFGAUgBCgBMgsImJKS1J_grD0QBUIVIhMIARIPCgtOTyBUcnVPcHRpaxABWgc2czB6YWV1YAFyBGtydXg.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838108179686794&event_type=page_request&timestamp=1726838108&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1726838108179686794&event_type=page_request&timestamp=1726838109&page_title=Threat%20Actors%20Exploit%20GeoServer%20Vulnerability%20CVE-2024-36401%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fthreat-actors-exploit-geoserver-vulnerability-cve-2024-36401&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=455648e0-305b-4d9c-a49f-bcd2fe39b2b6 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
401.tw
6033413.global.siteimproveanalytics.io
a.omappapi.com
a.opmnstr.com
aa.agkn.com
abm-tracking.demandscience.com
ad.doubleclick.net
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
b.6sc.co
bat.bing.com
bcp.crwdcntrl.net
c.6sc.co
cdn.cookielaw.org
cdn.jsdelivr.net
ce.lijit.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
d.agkn.com
dis.criteo.com
dpm.demdex.net
dx.mountain.com
eb2.3lift.com
eps.6sc.co
epsilon.6sense.com
fei.pro-market.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
i.simpli.fi
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
intentstream.contanuity.com
ipv6.6sc.co
j.6sc.co
loadm.exelator.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
pixels.argusplatform.com
ps.eyeota.net
px.ads.linkedin.com
px.mountain.com
px.steelhousemedia.com
px4.ads.linkedin.com
s.ad.smaato.net
script.crazyegg.com
secure.adnxs.com
simplifi.partners.tremorhub.com
siteimproveanalytics.com
snap.licdn.com
stags.bluekai.com
static.ads-twitter.com
sync.1rx.io
sync.bfmio.com
sync.crwdcntrl.net
sync.intentiq.com
sync.smartadserver.com
sync.targeting.unrulymedia.com
t.co
tag.simpli.fi
tags.inzynk.io
td.doubleclick.net
tmp.argusplatform.com
tr.outbrain.com
tracking.contanuity.com
tracking.crazyegg.com
trk.techtarget.com
um.simpli.fi
us-u.openx.net
usermatch.krxd.net
v.eps.6sc.co
wave.outbrain.com
webtracker.argusplatform.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.co.jp
www.google.com
www.googleadservices.com
www.googletagmanager.com
ad.doubleclick.net
tracking.contanuity.com
usermatch.krxd.net
www.fortinet.com
103.43.90.19
103.43.90.53
104.19.148.8
104.244.42.131
13.107.42.14
13.225.183.12
13.250.176.54
142.250.196.130
142.250.196.98
142.250.76.131
142.251.222.36
142.251.42.136
142.251.42.162
151.101.228.157
157.240.31.5
162.159.140.229
172.105.230.106
172.217.26.230
172.67.163.237
18.177.189.218
18.182.162.20
182.161.74.16
216.200.232.249
23.106.50.38
23.32.225.140
23.44.52.187
23.50.118.161
2400:52e0:1501::1193:1
2404:6800:4004:818::2008
2404:6800:4004:823::200e
2404:6800:4004:825::2002
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06
2600:140b:1a00:4::17c1:b89e
2600:140b:1c00:39::1732:7614
2600:140b:a00:383::1e80
2600:1901:0:8eee::
2600:1f18:612b:4200:439f:77e3:80bf:81be
2600:9000:26f2:6800:19:fc2c:a140:93a1
2600:9000:2751:aa00:12:dfa9:e200:93a1
2600:9000:27af:c200:1b:5138:8a40:93a1
2606:4700:3108::ac42:2af8
2606:4700:4400::6812:2089
2606:4700::6812:1247
2606:4700::6812:562a
2620:1ec:21::14
2620:1ec:33::10
2620:1ec:bdf::46
2a03:2880:f10f:187:face:b00c:0:25de
2a04:4e42:200::485
3.112.147.252
3.164.110.92
3.33.220.150
34.111.113.62
34.111.208.231
34.117.77.79
34.124.133.154
34.126.167.117
34.229.3.43
34.98.64.218
35.160.46.251
35.244.154.8
35.71.178.8
35.81.162.201
38.133.127.191
43.201.174.92
44.226.187.177
52.10.121.135
52.27.42.108
52.32.164.86
52.6.242.65
52.88.179.26
52.89.99.220
54.183.57.53
54.203.236.163
54.251.109.127
57.180.73.140
63.140.50.191
63.140.50.233
69.173.158.64
74.118.186.107
75.2.108.141
76.223.9.105
0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096
07405b002bac345765f6de032ed07cac28e77745e73850bf4aed8f891822c37a
097fa6ca8edc9ac17a821a258fbf1d4357e4704d7f9056199ef364df1d1377d1
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0be9fc1923bfa5bd67a699ff0f49420e460c09b27bcb63dd4d682a0fa2ef5b5a
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0cb27f8572cbc2abecb4fe2d5291d6c4f6f21f7e7d7e3ceb0b57211b00e1b79a
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
10fc9a12b905f9f21665f11fa5b183eae31166f74fce090bf179eb4c823b5ecc
11c69167edad4aa2ac0c3def81f10e2caf7375ca37d9170e9277ac2cef39eb32
12e52d0f46a9b73b04be82a6c628fea98bb3ad9652332ce7faff9b4447e2d3ca
15c2c29198d9315260cc26261e96a036d215fa28a46836302a576392e0e20ecd
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
217ba4b460ea7bc3ea3dcf1e24b56335d36a7a70c748d3d778a00378918b0d30
21aaea8d55693ea73c2e3d8afbf8358f3bfa56ae0d8a0abb07221a83373da2d5
229849a4c44505b2599f1a321b139fb5ab32d04a4e0f8d9844b1827e60b80d9f
2589fe281a342d19f8ddcd924727496b916202c4e42edb2553f25074746db938
266c05a4179d82e44435b53e3c59feca1da023ca374782167149451932672d70
291ac3898f3f28bd32810a5ef0f380363afee480e535632f0254da751f775c63
29af3002eb8a7685cfc6a2c81f99ac0058c2f9975996d21a0e696e4c1f8e7bfa
2c88a96aaccfda2bf3f3c29d069fea858423e9cebcc1392a1021ec76538498ba
2cc20824e35c6be438211ca8dcf0baa6b8e6df5473454d953a0c96d10eedae7e
2d0ddcf9662d44f133470ee7c926c568e540874718195167d7ce2eae31839a2c
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2eceae481c2cda87ecdc8e65c8bbd62ddc9538144c42ff6c1cd720cd5781623c
2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
320f37b3eca2011055c9ab5a10b5de0f57a22fd740e504fe7e02c9898041abbb
351ba146db40e108b8dcbf0f9cc288d6cc19615020b2aeb1c0f508b79e78b93e
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
38cfaeb6a3cb2cff2b9b11f9945838fd640ac7c0483e093239a29400c7d2ee66
3a08b9098028e5492689bf6443fcef194114b2f20d7ec50c12108ae02cec6a3e
3d6bc3dbcf9e2cf02f556ae8bd0936e8b62540189823df29c4f524c060bb8328
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44fc655655fedce3141e358eabb02c39e838d48e6643b1c58c395adfc23757d2
4713f4e99bebe488012bb9f5ccbaa25d83f2ecec4dbfc2c71f81ad33df9d1c10
4b1017ddd583b8790466a28987a1dabd2d750fcbc0dbffbf263bee2e4cd35791
4b2f0e0711acd760eb646295c4165bb0122ea7951beb3c5ac0ff053171e3dfab
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4ba983e91c925e7b64efe7f971562edadf297d05f8f648f8d8060aa955649ac0
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e087b4fdf2d01e82e172c013dadf27dd879737dd595df92fa435f4662538d51
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
5072cb8f4c6522e91c53fa0b2c4a36a3aa078b5b78ac9d48f317649a055a1e1d
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
59d12a10e99345ccbe1776752be1dcab5d337248fb1f523fb3cf93ffecf3a779
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5b7b4be8ed582776a1ad52eed0fe06afe968c34e31d566c473feb92ac6a270e0
5b7e10ef15a4fdfd73c69fa16e91aef21861455628f5ac87e72bb5f951e9976c
5ef0e68967411e0314dcc9b45416c54100ebf112f0fc6dc08cc3e1f1f9fa0436
5f83323b31dd79cc7f9104b638a2706b0e12b6e521f48d21ba638b67279f4417
609ca44aa6a92944559e4d17e84e29651b391c6c3438184474fd67e602250e7d
61c4417c2b9d4cba0069ef57a404bd5d9c7a7e4c768f57747b1c084cb9b373ce
6277e3210b9fb4b3b4f0d452b7f91bda534fb23f8ecbe7f9b15dcdf85626cea6
6305f99e66b3ae3c375efe4b1128ab3dcdc2d66c63b97ba6b891096de9b20b9d
6bb4e76fdeac3f86fe514013ea4ec43b69cf824a9cb00b4d90ca33eb27df3712
6c96e2d7e3d052c2c4fc96b42a991077b82cc1118c272a97b8c2880a1ebd9357
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552
701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f
706300e054788f930de76af585fc6511091289d01c65c440964ca6abb898e7dc
71a46dab6ee04f3c70340e06651cc5a57ccb8c30e7635dfb8d487cbe8d657b80
71e3c0057bec6dab5d49a1b6994c8e4fffa97614ba115bc8747a2be7c43ed048
7398e1925f57dbcd83bdf384077c1f8d010ad1e70c0b31f2a10f7a0c190d851a
73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4
73ade03dfeae221bb318514f70aa5ae9c9c653b6871008ef9a3596f9255a78f1
7701282ea59743a1d336ee5ede4e6805ca9572c28ad013fa956fb39f18de0d69
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
7a520fb2812687266f06520e650deb9dece37e49629623c4be612b1f561e11df
7ad0607daba7c0ddecacb3c696099e761076f147549440a7b3c4baa8f67ddaac
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
7fc88a2ccff93251684fc0526a1ef83f6b65bccc949e449d86f4df1bf945da94
8109fbd42099eef3aed0564d81e4502bade4a64b6bd5174894f0f1e8019cd421
83201017e411b72434080a221b102049e9074e205d97f65219d2286abd683012
8489534bde4ad3c3cedebecd11b9babe653de6b413922ec2b877c5bfcb33ee3e
88a5f8b5bcd4b32ed398b199bfc0ecf20ba41bf544d2ca04bc40111db7c66ab3
89905a0e0efe1119d95b1e69de27157b35b8043115708fa06eb74dc706568a7b
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
8a84bc1c645bc2d9b6e41e4e8b4582c2dbd3569b51df5ecedc989410e6be8fe7
8b195a98b1a9fa227dd6712c4af7ccbd807baa4a4b21491d97dbc09c1e13798a
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
8d121b33124fce841c6927c1214d2aa4fe7e5c52629de45f68f325f749a5857d
8db92e7cdc1ad40168c42e93b05d842e056d8a5b83ae96b95d2b1c546f828196
8dbdd526d3da8b4924bc169cb3faee88cda6da11742ef935ae2e916a17b7d978
8ff6ee1950e6f70a130f69e94e575f9d5f7c5de60be4be09311deedeb91e6d61
904ada5a93d55f8c5412c4472a62bfbc46e215422ebdea166d95ed3434d97d4f
91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f
930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6
94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66
956915db9ed8f96ac4ee123a7909637e7db25f3ea20e41927c5fcc4fd50108ee
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d
9a57c6cd6129a6ae679af72011e4529d2c322ff41ca4933dedd76150ffcae369
9ae293c59bba08f1a56f697a11015ee4b251b0f38c309f83c80d7f6e7369caa4
9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36
9cbf9589d98422a08f788b3863a74d1a27c3d92289f8829620c4d8925b967b94
9f313c8c3aaec2c1b82bdf04b99d12b5b456dd6e4ccb2957e7a584c42683eba5
a036dd51b9d09070b4cb8eaa91c1a5abac51f7027e9741c79343a35411be739c
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a4b0a228372854369707f452fb9124e5bc34319c8c3323b5379111ac9ba4bac6
a70d3b4d492439d9ee9225cd56601b2f229938c2a6d74e12398e379d43b84114
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab5b000d7c8c84f2cc6dbaacd88498126fa4b2fcb04cf14ae9fcd8eef9623760
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae7508b6af434ce1865c89b657732af23480ae3326b43fdcdcc43ac679723c10
ae7d18a41edd5f27e717f872a1113addddbf1553e00b3db1baefa99b68fda302
af89d0f65e1c53f2831c1b73f25ee3053fddc6551962dc58eada982a2fd99bdd
b0f83ebd635879a4d8d43ad3379b45e32d2d27f541271977ff850a78706fe70b
b124eed22afdf03abf94714c7632d5f462c0fca7725d014a4469f3b4a0f1083d
b133508601dd82610cda75ed20bc034dd90b459dcd74b8b44e75998e38d19477
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15
b4cf9a1c5e59761a8992b1692b7490a2c5bc428dfb4f84fc3b342edc51c8c06a
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
b66a76be051ae670f5c2786172af1a704f1ecdb15aea3c3402fb42b9e5470598
b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb50d0022dac04a6c6a2fc5edf927a4682c8e6b73a970546c75ff118f06ad4e0
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869
c3a522b15c8dd585c2cb4e503fdce8145d08a8eccb0e2cd7138864bba293c843
c49ef55655c4da0adfe3cd86a5db075951a3a1aca41788b409188e5de27a06a2
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86
c6c7eafdd4ce7cbca90175e42e4d11a9ebcfaed70b6471572a0d3d0ae7dde57f
c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59
c8bd087cae26989a1701124643c9a37dded01b67d7f0943c75941dd6323664fa
c93daa60f006a86838fbbb7bae3dde20014d13e56f19d6c15099ca00657d572c
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cee682bc57d94c16933b0422aa0bd7ad8c7a6e04643eb7ce170e2d5ce6e25b48
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfbffc5a6b6598cb0bf93565da00397f881e0198bf2f24c8d963e4c7cfb45abf
d04f03c209c8b79223d1147dec2771c3e87a401dc1348b7dd10de0aa7d22297f
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2ac7d5402f2266e77a525cf70164ad40fb86b0981530cad5af3e3610a209768
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d98bf7483812de53be541b21b22b1cc519065b76ed31780f33bf8254e688812f
da9671920127171a9289888088dc3d9f3b62f2af8c3ac142f456faa1d49eccda
daaa79b81fa49a10852df79446783b9c51de167ee31aaff722e030c6cacc674b
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
df9f1f8f4deeec8193dbcf3074a9e4767db05cc6c3b4dca6a9cafff884fb0816
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e708a54b75ed6fd1fe7886153e485c91697f1ab440feed4efd10262575b7e7cb
e72fc9693b94bd6f4cea4fa172adc70989eca7c72cbdcb48f51ceaa7063ab230
e8f00eb416ad5af6f4524e1b7efd086a2244bf48757eee0fbdf583c20afa1dad
ec58ceb768e02c31b87f084fbe10f719b0c42d29c98fcca298688768c6f899e2
ee555b56d11e10b0a60e50d84be13221d318b328d16a7b59d77bb5dc7007e4d2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f188b1683849ebab2c42aa623674d573d89c3a8b8a533f4e2ec35fe7a9e8000e
f1f9db6482608adf3e3a8afae1696750668fa36428265807fbdcfc43eb6691f7
f2771985061ab617dd696611136d31d58dba565372eaf86c562d59d8bae3fd9d
f4eef873faaecfdeedc996d3f32d0c4d6775a01d0069afe29eb08e0080159899
f8f726a217af8471c5c0e2c11fca16865b7dc42485185311fcbfa0603a4f7120
f90b5ef7baa9dfccda582eb0ec80a2e2848cd5b3edc866629cda33cf4ff6df48
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fd688f7a638dad7a8d7c394f5443ed8ccb3158d4555937c1e0f51546b2fc9612
fd9f918bd5a22813d48748b8c79e2acaeeb590d217575e0d79d734cba9de7736
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ffc203bbbd97d035fe4167f82bc351cbb08bd237b85e60285f33a1f44ef23886

www.fortinet.com Open in urlscan Pro 2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

238 Requests

87 %HTTPS

27 %IPv6

64 Domains

91 Subdomains

73 IPs

6 Countries

6826 kBTransfer

10691 kBSize

111 Cookies

21 Outgoing links

Page URL History

Redirected requests

238 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.fortinet.com Open in urlscan Pro
2406:da18:ad1:1102:e3ad:8cb3:e698:cb06 Public Scan

Screenshot
Live screenshot

Full Image

238
Requests

87 %
HTTPS

27 %
IPv6

64
Domains

91
Subdomains

73
IPs

6
Countries

6826 kB
Transfer

10691 kB
Size

111
Cookies

238 HTTP transactions
2 data transactions