www.mandiant.com Open in urlscan Pro
2606:4700:300b::a29f:f17d Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation
Submission: On February 12 via api (February 12th 2024, 12:41:18 pm UTC) from IN — Scanned from DE

Summary HTTP 90 Redirects Links 32 Behaviour Indicators

Summary

This website contacted 31 IPs in 3 countries across 25 domains to perform 90 HTTP transactions. The main IP is 2606:4700:300b::a29f:f17d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.mandiant.com. The Cisco Umbrella rank of the primary domain is 375781.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 2nd 2023. Valid for: a year.

This is the only time www.mandiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
26	2606:4700:300... 2606:4700:300b::a29f:f17d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:310... 2606:4700:3108::ac42:292d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
3	2606:4700:10:... 2606:4700:10::6816:47c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
1	199.232.188.157 199.232.188.157	54113 (FASTLY) (FASTLY)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:1496	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f08... 2a03:2880:f084:105:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2001:4860:480... 2001:4860:4802:36::178	15169 (GOOGLE) (GOOGLE)
1	13.224.245.27 13.224.245.27	16509 (AMAZON-02) (AMAZON-02)
2	88.221.60.75 88.221.60.75	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700::68... 2606:4700::6811:129	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c0a::9d	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
3 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2620:1ec:22::14 2620:1ec:22::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	99.84.88.30 99.84.88.30	16509 (AMAZON-02) (AMAZON-02)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
2	52.22.223.182 52.22.223.182	14618 (AMAZON-AES) (AMAZON-AES)
1	2a03:2880:f17... 2a03:2880:f177:185:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	151.101.2.137 151.101.2.137	54113 (FASTLY) (FASTLY)
8	2.17.100.184 2.17.100.184	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	162.247.243.29 162.247.243.29	54113 (FASTLY) (FASTLY)
1	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
90	31

26 2606:4700:300b::a29f:f17d (United States)

ASN13335 (CLOUDFLARENET, US)

www.mandiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:292d (United States)

ASN13335 (CLOUDFLARENET, US)

cdn4.iconfinder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::6816:47c5 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.188.157 (Munich, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:1496 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:36::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.245.27 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-245-27.lhr62.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.221.60.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:129 (United States)

ASN13335 (CLOUDFLARENET, US)

scout-cdn.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0a::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:22::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.88.30 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-88-30.muc50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

565-pei-952.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.22.223.182 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-223-182.compute-1.amazonaws.com

scout.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2.17.100.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-184.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.243.29 (United States)

ASN54113 (FASTLY, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ab00::214:8e70 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	mandiant.com www.mandiant.com — Cisco Umbrella Rank: 375781	1 MB
10	google.com www.google.com — Cisco Umbrella Rank: 2 region1.analytics.google.com — Cisco Umbrella Rank: 2720	76 KB
9	6sc.co j.6sc.co — Cisco Umbrella Rank: 5424 c.6sc.co — Cisco Umbrella Rank: 8319 ipv6.6sc.co — Cisco Umbrella Rank: 5585 b.6sc.co — Cisco Umbrella Rank: 3739	21 KB
9	gstatic.com www.gstatic.com	1 MB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 333 www.linkedin.com — Cisco Umbrella Rank: 631 px4.ads.linkedin.com — Cisco Umbrella Rank: 6421	4 KB
3	salesloft.com scout-cdn.salesloft.com — Cisco Umbrella Rank: 9956 scout.salesloft.com — Cisco Umbrella Rank: 12673	4 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 363	14 KB
3	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 3721	28 KB
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 80	394 B
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3613	8 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 695 script.hotjar.com — Cisco Umbrella Rank: 1019	59 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 171	69 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	208 KB
1	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 230	404 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 602	16 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 102	185 B
1	mktoresp.com 565-pei-952.mktoresp.com	318 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 774	395 B
1	t.co t.co — Cisco Umbrella Rank: 643	378 B
1	google.de www.google.de — Cisco Umbrella Rank: 6562	408 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 792	16 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 749	15 KB
1	iconfinder.com cdn4.iconfinder.com — Cisco Umbrella Rank: 93134	5 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 223	5 KB
90	25

	Domain	Requested by
26	www.mandiant.com	www.mandiant.com
9	www.gstatic.com	www.google.com
9	www.google.com	www.mandiant.com www.gstatic.com www.google.com
6	b.6sc.co
4	px.ads.linkedin.com	3 redirects snap.licdn.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.mandiant.com
3	static.addtoany.com	www.mandiant.com static.addtoany.com
2	scout.salesloft.com	scout-cdn.salesloft.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	munchkin.marketo.net	www.mandiant.com munchkin.marketo.net
2	connect.facebook.net	www.googletagmanager.com connect.facebook.net
2	www.googletagmanager.com	www.mandiant.com www.googletagmanager.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	bam.nr-data.net	js-agent.newrelic.com
1	j.6sc.co	www.mandiant.com
1	js-agent.newrelic.com	www.mandiant.com
1	www.facebook.com	www.mandiant.com
1	565-pei-952.mktoresp.com	munchkin.marketo.net
1	script.hotjar.com	static.hotjar.com
1	analytics.twitter.com	www.mandiant.com
1	t.co	www.mandiant.com
1	px4.ads.linkedin.com	www.mandiant.com
1	www.linkedin.com	1 redirects
1	www.google.de	www.mandiant.com
1	region1.analytics.google.com	www.googletagmanager.com
1	scout-cdn.salesloft.com	www.mandiant.com
1	static.hotjar.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	cdn4.iconfinder.com	www.mandiant.com
1	cdnjs.cloudflare.com	www.mandiant.com
90	33

This site contains links to these domains. Also see Links.

Domain
cloud.google.com
careers.google.com
login.mandiant.com
www.mandiant.fr
www.mandiant.de
www.mandiant.it
www.mandiant.jp
www.mandiant.kr
www.mandiant.es
nvd.nist.gov
www.ivanti.com
advantage.mandiant.com
services.google.com
forums.ivanti.com
www.volexity.com
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com
selling.mandiant.com
policies.google.com

Subject Issuer	Validity	Valid
mandiant.com Cloudflare Inc ECC CA-3	`2023-04-02` - `2024-04-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
iconfinder.com E1	`2024-01-31` - `2024-04-30`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
static.addtoany.com E1	`2023-12-27` - `2024-03-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-21` - `2024-02-19`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-01-21` - `2024-06-27`	5 months	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
salesloft.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-20` - `2024-04-18`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-01-15` - `2025-02-15`	a year	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2024-10-01`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation
Frame ID: 0A6A6536282316D3BC37B76EA1D28BB9
Requests: 73 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: 402843F64B0E7D93F4E4EE047BF1296D
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=normal&cb=ixb1eexgxwj8
Frame ID: 51D7309E3B8ACF194A0756B3B3E01302
Requests: 5 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=compact&cb=jlydal65l5aw
Frame ID: 5A1FBCA2322700E7079ED9D1C61473CD
Requests: 5 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: 9C68BACE964EA9871F2AC432B3081C2C
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: 17F47BA277C70C8AB245139DA77C370C
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation | Mandiant

Detected technologies

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

90
Requests

98 %
HTTPS

61 %
IPv6

25
Domains

33
Subdomains

31
IPs

3
Countries

3120 kB
Transfer

7070 kB
Size

28
Cookies

32 Outgoing links

These are links going to different origins than the main page.

URL: https://cloud.google.com/security/sec-ops
Title: Breach Analytics for Chronicle Know what we know when we know it

Search URL Search Domain Scan URL

URL: https://careers.google.com/
Title: Careers Life at Mandiant and open roles

Search URL Search Domain Scan URL

URL: https://login.mandiant.com/
Title: Sign in to Advantage

Search URL Search Domain Scan URL

URL: https://www.mandiant.fr/
Title: Français

Search URL Search Domain Scan URL

URL: https://www.mandiant.de/
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://www.mandiant.it/
Title: Italiano

Search URL Search Domain Scan URL

URL: https://www.mandiant.jp/
Title: 日本

Search URL Search Domain Scan URL

URL: https://www.mandiant.kr/
Title: 한국어

Search URL Search Domain Scan URL

URL: https://www.mandiant.es/
Title: Español

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-46805
Title: CVE-2023-46805

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-21887
Title: CVE-2024-21887

Search URL Search Domain Scan URL

URL: https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways
Title: disclosed

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/actors/threat-actor--b797832d-0411-5574-b7cf-c51b22e08423
Title: UNC5221

Search URL Search Domain Scan URL

URL: https://services.google.com/fh/files/misc/ivanti-connect-secure-remediation-hardening.pdf
Title: hardening guide

Search URL Search Domain Scan URL

URL: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
Title: mitigation

Search URL Search Domain Scan URL

URL: https://forums.ivanti.com/s/article/KB44755?language=en_US
Title: Integrity Checker Tool

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/malware/malware--96732cf0-d99a-501b-9646-c49f2b30dd5a
Title: BUSHWALK

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/malware/malware--089bf6cc-9b67-5bd5-8fd3-3330e7cedf7e
Title: LIGHTWIRE

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/malware/malware--4a3560fd-5ec5-5581-a8f7-1c888d28186b
Title: CHAINLINE

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/malware/malware--30efd16a-3713-5899-b45a-50faff982887
Title: FRAMESTING

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/malware/malware--5748ec82-ef1a-5180-9af0-f2ce9721f315
Title: ZIPLINE

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/malware/malware--8bca5c95-0c82-55d7-8173-a5369c956dbf
Title: WARPWIRE

Search URL Search Domain Scan URL

URL: https://forums.ivanti.com/s/article/Recovery-Steps-Related-to-CVE-2023-46805-and-CVE-2024-21887?language=en_US
Title: guidance

Search URL Search Domain Scan URL

URL: https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/
Title: blog post

Search URL Search Domain Scan URL

URL: https://cloud.google.com/resources/security/cybersecurity-forecast?utm_source=mandiant&utm_medium=website&utm_campaign=FY23-Q4-global-PROD613-website-dl-security-forecast-2024&utm_content=-&utm_term=-
Title: Download now

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Mandiant

Search URL Search Domain Scan URL

URL: https://twitter.com/Mandiant

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCexu0DP7VKdDByusuTA53FQ

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/mandiant/

Search URL Search Domain Scan URL

URL: https://selling.mandiant.com/mandiant/sso.aspx
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy?hl=en-US
Title: Website Privacy Policy

Search URL Search Domain Scan URL

URL: https://cloud.google.com/product-terms#section-15
Title: Terms & Conditions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 41

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1707741673221&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1707741673221&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3460746%26time%3D1707741673221%26url%3Dhttps%253A%252F%252Fwww.mandiant.com%252Fresources%252Fblog%252Finvestigating-ivanti-zero-day-exploitation%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1707741673221&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1707741673221&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&cookiesTest=true&liSync=true&e_ipv6=AQKv8Cq_Xdv_kAAAAY2dVfmGQ-COodIUhs9UjtckEx1JiZsQ5oRiSkEGnF9oovbF_svgXB3qLi96_N3eYu3ltIzZ0V3vcg

90 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request investigating-ivanti-zero-day-exploitation Show response
www.mandiant.com/resources/blog/ 182 KB
46 KB 473ms
442ms Document
text/html 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

325d8189deb081774080e392822404a86c041898c0cfeee7357b828cf9e3c402

Security Headers

Name	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: public, max-age=2764800, stale-if-error=3600, stale-while-revalidate=3600
cf-cache-status: REVALIDATED
cf-ray: 8544e7889af25b8c-FRA
content-encoding: gzip
content-language: en
content-security-policy: report-uri /report-csp-violation
content-type: text/html; charset=UTF-8
date: Mon, 12 Feb 2024 12:41:12 GMT
expect-ct: max-age=86400
expires: Sun, 19 Nov 1978 05:00:00 GMT
last-modified: Mon, 12 Feb 2024 06:13:28 GMT
referrer-policy: strict-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
surrogate-control: max-age=86400
vary: Cookie,Accept-Encoding
via: varnish
x-ah-environment: prod
x-cache: HIT
x-cache-hits: 8
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: v-d6e19e86-c96d-11ee-8594-cf95d8c56ece
x-xss-protection: 1; mode=block

GET
H2 200 css_wUPPuZ3Qqai7aw43G9pF5saoexG_XVtJ5QEhvZ4kBoA.css
www.mandiant.com/sites/default/files/css/ 22 KB
5 KB 782ms
781ms Stylesheet
text/css 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_wUPPuZ3Qqai7aw43G9pF5saoexG_XVtJ5QEhvZ4kBoA.css?delta=0&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ad97474c633fd0ce7bfb7934ac7947ef210c58ac3ae66fd6785f6b211fec885

Security Headers

Name	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:12 GMT
content-encoding: gzip
via: varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri /report-csp-violation
x-cache: MISS
x-ah-environment: prod
x-xss-protection: 1; mode=block
x-request-id: v-0122d12a-c9a4-11ee-af44-6bc4d059c000
referrer-policy: strict-origin
last-modified: Mon, 12 Feb 2024 12:32:46 GMT
server: cloudflare
expect-ct: max-age=86400
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-language: en
content-type: text/css; charset=UTF-8
cache-control: public, max-age=300
cf-ray: 8544e78b6c4b5b8c-FRA
expires: Mon, 12 Feb 2024 12:46:12 GMT

GET
H2 200 css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css
www.mandiant.com/sites/default/files/css/ 709 KB
83 KB 428ms
427ms Stylesheet
text/css 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1e44b7039bdfb7c21f22c9c68dc18d01b6db90860e556ac1781f5c1f50940a58

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 65653
date: Mon, 12 Feb 2024 12:41:12 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 84746
x-request-id: v-0512af74-c0eb-11ee-84b1-3b2cc7b34cf0
last-modified: Thu, 01 Feb 2024 10:13:42 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e78b6c4c5b8c-FRA
expires: Mon, 26 Feb 2024 12:41:12 GMT

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/ 23 KB
5 KB 37ms
20ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 7984429
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4364
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-5cbb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jqBM5aNyz%2FXB6n%2BAJaqES%2BHaoJKd2hQykGCOzGsVcukrzJCy07PJBwXg%2FaLyMItB8ZL0lrrhwak20Gkplaw18iFAwoMGp12iqZ1D3FzJjLIMsD0zKirygaCwOtf8cbQKMIq5kSfc98NEVoeenV%2FnC9Jt"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8544e78b7ac365bc-FRA
expires: Sat, 01 Feb 2025 12:41:12 GMT

GET
H2 200 icon-close-512.png
cdn4.iconfinder.com/data/icons/ionicons/512/ 4 KB
5 KB 63ms
29ms Image
image/webp 2606:4700:3108::ac42:292d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn4.iconfinder.com/data/icons/ionicons/512/icon-close-512.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:292d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7762b4265e6050c33745fd1fae5110f9f265564f0a85d9ac01efaa65029db59c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 1310847
cf-polished: origFmt=png, origSize=8351
content-disposition: inline; filename="icon-close-512.webp"
alt-svc: h3=":443"; ma=86400
content-length: 3858
x-request-id: c3c461dc-8b7b-4531-9ebe-0097f2cfce10
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1706305076&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=wDVQi7mFTl8Hr5jlCDpvF66RP%2BcFjk4w5D%2FKr%2FWD2MM%3D
cf-bgj: imgq:100,h2pri
last-modified: Fri, 26 Jan 2024 21:37:56 GMT
server: cloudflare
vary: Accept
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1706305076&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=wDVQi7mFTl8Hr5jlCDpvF66RP%2BcFjk4w5D%2FKr%2FWD2MM%3D"}]}
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8544e7908b3f694b-FRA
expires: Tue, 11 Feb 2025 12:41:13 GMT

GET
H2 200 google-cloud-logo.png
www.mandiant.com/sites/default/files/2023-11/ 6 KB
6 KB 420ms
420ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2023-11/google-cloud-logo.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

143f4d7f6d2c5abca7590a6dec282876ef49bc849c886fc7eefbfe3e1c6706fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 63677
date: Mon, 12 Feb 2024 12:41:12 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 6094
x-request-id: v-db1a75d0-c0ea-11ee-b870-cbe059bbf061
last-modified: Wed, 08 Nov 2023 10:03:19 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e78b8c5b5b8c-FRA
expires: Mon, 26 Feb 2024 12:41:12 GMT

GET
H2 200 js_BPlJ5CkwI26JeJAktA4F-3H9DqW1WmOxI5SNOEaeTtM.js Show response
www.mandiant.com/sites/default/files/js/ 94 KB
34 KB 800ms
800ms Script
text/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_BPlJ5CkwI26JeJAktA4F-3H9DqW1WmOxI5SNOEaeTtM.js?scope=footer&delta=0&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a4437ac3034c29f937cc15fc401fe5aeef7b4a6df042b8de0ddad795fff3f8d9

Security Headers

Name	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: varnish
cf-cache-status: EXPIRED
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: report-uri /report-csp-violation
x-cache: MISS
x-ah-environment: prod
x-xss-protection: 1; mode=block
x-request-id: v-012445b4-c9a4-11ee-8c93-cbe7b289e096
referrer-policy: strict-origin
last-modified: Mon, 12 Feb 2024 12:32:47 GMT
server: cloudflare
expect-ct: max-age=86400
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-language: en
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=300
cf-ray: 8544e78b8c5c5b8c-FRA
expires: Mon, 12 Feb 2024 12:46:13 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 39ms
17ms Script
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a8e5cd4fe515c0e6afe5713bb0bb7494d7e6106e1a23cb4d6a430f13aabed6e1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Mon, 12 Feb 2024 12:41:13 GMT

GET
H2 200 js_Jwg74cbTqqSmLmvJL2k5ji0fYez8lMqiB6d-hsTu9JU.js Show response
www.mandiant.com/sites/default/files/js/ 2 KB
1 KB 419ms
418ms Script
text/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_Jwg74cbTqqSmLmvJL2k5ji0fYez8lMqiB6d-hsTu9JU.js?scope=footer&delta=2&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9635aa800a995e86f3894d9a6fd5f530ae00da2937442f0795ae213b42782ba8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 47286
date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 930
x-request-id: v-dee94588-c0ea-11ee-9240-fb3804b1c9f2
last-modified: Thu, 01 Feb 2024 10:15:48 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e78e2dbf5b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 49ms
23ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a3d8c061a2a585985a71d5b1a45c424c5bc79b310c86b4731b5bececf5ea5df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 27390
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"257f9651f9cfd949f6dde30f51352116"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ibutSFgL5dNkvGi%2FbcD9zFL7dPmtNBfrrf9Kr5fwhttgRb7B0fVtpXm1yzKQ2Mj%2BTqt2kX%2F4lRz%2FLjFbrqDWicyFyknXq1u4by4omVGZTnxhSYrgOGtmlj%2F4xmVu%2FiSrxbRDVgwOrOgCSYusq9bZdKvZ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400, stale-while-revalidate=30, public
cf-ray: 8544e7907c6a2c2b-FRA

GET
H2 200 js_3j24uFU9OMU68V7podrhLUkKysvljLnYFg9cxMvqtJc.js Show response
www.mandiant.com/sites/default/files/js/ 416 KB
124 KB 420ms
419ms Script
text/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_3j24uFU9OMU68V7podrhLUkKysvljLnYFg9cxMvqtJc.js?scope=footer&delta=4&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fa7ca84dc3a040c7199206d3554b4b57d6cbb5c49ef435f674103587640d26a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 6589
date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 126527
x-request-id: v-db2c2e92-c0ea-11ee-b4b7-1f31d93fb048
last-modified: Thu, 01 Feb 2024 10:13:54 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7904f165b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 accordion.frontend.min.js Show response
www.mandiant.com/modules/contrib/ckeditor_accordion/js/ 4 KB
2 KB 424ms
423ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/modules/contrib/ckeditor_accordion/js/accordion.frontend.min.js?s8kvgw

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9474894bf64b11c40884f83b0ba6888635bf90bfaae11db1944d99771f1c820

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 191048
date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: gzip
via: varnish
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
age: 277882
x-cache: HIT
x-ah-environment: prod
content-length: 1535
x-request-id: v-02ac248a-c71d-11ee-ae3c-5ff98e24ce8f
last-modified: Wed, 24 Jan 2024 07:40:28 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7904f185b8c-FRA
expires: Fri, 23 Feb 2024 07:29:50 GMT

GET
H2 200 js_6xf1lzGOPZAdgcyxOnZxp_EtFSRnOO0Xs6LcsFhpsQo.js Show response
www.mandiant.com/sites/default/files/js/ 20 KB
6 KB 425ms
424ms Script
text/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_6xf1lzGOPZAdgcyxOnZxp_EtFSRnOO0Xs6LcsFhpsQo.js?scope=footer&delta=6&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3245f6cb8d40eebea048a60b056d9a48cbc3e1b0309a0a4cb0e51280f6b0c712

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 51197
date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 6309
x-request-id: v-db4f0b2e-c0ea-11ee-aa7a-370b96ede0a7
last-modified: Thu, 01 Feb 2024 10:13:43 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7904f195b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 fontloader.built.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 7 KB
2 KB 417ms
417ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/fontloader.built.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 77533
date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 2334
x-request-id: v-df4b143e-c0ea-11ee-b4ab-47a48a0b2668
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7904f1a5b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 410 KB
116 KB 87ms
66ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b37bfa474106bcdd85a364261bc9d4458ee55d670a08bf76fa61ea1596ea7ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 117847
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 12 Feb 2024 12:41:13 GMT

GET
H2 200 gray-circle.png
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/backgrounds/ 9 KB
9 KB 421ms
421ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/backgrounds/gray-circle.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cfbbb6a8bb9482b6bddbba133d70d9ac28fea886ede20ecdaf3110d5c70dba6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 64784
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 8943
x-request-id: v-df61a596-c0ea-11ee-9608-2f1466b3253e
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7905f275b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 insights-for-future-planning.png
www.mandiant.com/sites/default/files/2023-11/ 149 KB
149 KB 420ms
419ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2023-11/insights-for-future-planning.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

acb33e5d72259c82bef8f6d6ddfc56bbdf4130739d3271a437b4d0065c390d9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 61725
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 152443
x-request-id: v-dc1a9ea6-c0ea-11ee-a61e-8ba50edbe7a8
last-modified: Wed, 08 Nov 2023 10:02:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7906f325b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 magenta-to-red-gradient.jpg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 61 KB
61 KB 432ms
431ms Image
image/jpeg 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/magenta-to-red-gradient.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce56dc3783735b873af61135d410e3ccec9dfd565a5961fd707e85d1d6b654af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 71914
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 62175
x-request-id: v-dc1c27f8-c0ea-11ee-bd4f-57adfa8c2843
last-modified: Wed, 26 Oct 2022 19:35:16 GMT
cf-bgj: h2pri
server: cloudflare
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7906f335b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 white-cta-arrow.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 750 B
477 B 55ms
54ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/white-cta-arrow.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff46ab88d5fe2880ee24e0a56c4f423096ea4eb7b80e0fc8032319e26b5a002b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 74922
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 300
x-cache: HIT
x-ah-environment: prod
x-request-id: v-dbf414ac-c0ea-11ee-9898-bf7d4f30e08e
last-modified: Wed, 26 Oct 2022 19:55:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 8544e7906f355b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 footer-bg-transparent.png
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 134 KB
134 KB 29ms
29ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/footer-bg-transparent.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 77364
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 300
x-cache: HIT
x-ah-environment: prod
content-length: 136986
x-request-id: v-dc393ad2-c0ea-11ee-9192-f3e5a2249cbe
last-modified: Wed, 26 Oct 2022 19:35:16 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7906f365b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 MaterialIcons-Outlined.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/ 148 KB
148 KB 416ms
416ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/MaterialIcons-Outlined.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 89876
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 151244
x-request-id: v-db17d19a-c0ea-11ee-ba03-9b74c921fcd9
last-modified: Wed, 26 Oct 2022 19:55:35 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7907f385b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 Barlow-Bold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 56 KB
56 KB 414ms
414ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Bold.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 86143
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 57572
x-request-id: v-db14d260-c0ea-11ee-a50b-3f241317df8e
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7907f3a5b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 Barlow-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 55 KB
55 KB 421ms
421ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Regular.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 88404
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 56020
x-request-id: v-debbf470-c0ea-11ee-9050-2f9498560a88
last-modified: Wed, 26 Oct 2022 19:35:15 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7907f3b5b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 GoogleSansDisplay-Medium.ttf
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/ 154 KB
154 KB 422ms
422ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/GoogleSansDisplay-Medium.ttf

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f76ce833f021609c95e4f7aa037a19cfb33bcfe5dd6e25ead5b6fb61add6050

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 73164
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 157860
x-request-id: v-db151914-c0ea-11ee-bb1c-03265a85170e
last-modified: Wed, 22 Feb 2023 07:03:43 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7907f3e5b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 GoogleSans-Regular.ttf
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/ 154 KB
154 KB 420ms
420ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/GoogleSans-Regular.ttf

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db8889219047b9dab1299759fc44d56af45ee4e683961df1d54d1f0ef783690a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 71212
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 157868
x-request-id: v-db583078-c0ea-11ee-afd5-bb1e43d6da54
last-modified: Wed, 22 Feb 2023 07:03:43 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e7907f405b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 280 KB
92 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

789a132a2a269c0b47e3df2e1b3080cc7afaf36a2239d99effe7f6df5d8acfce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 94448
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 12 Feb 2024 12:41:13 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 50ms
12ms Script
application/javascript 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-muc13937-MUC

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 43 KB
16 KB 35ms
6ms Script
application/javascript 2a02:26f0:3500:16::215:1496
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1496 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b5474d3ed408366dcebededf5c987f44b43b389137272c282c6c972852a14fc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 23 Jan 2024 14:42:29 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=64764
accept-ranges: bytes
content-length: 15732

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 214 KB
58 KB 27ms
8ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bca51ed2fe251488a1b150edf560d43880f1486740f34d24120ede486f99676b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 12 Feb 2024 12:41:13 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57257
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: aSx7ADGwG0yN8idhMY+ET/by4kd8CUk0+rm7r3ceFbuGUXjGjbRa25ivqwCLYqvHFGgCAWmpPcGCGrjO7TBJiw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 59ms
42ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Mon, 12 Feb 2024 12:41:12 GMT
last-modified: Fri, 10 Nov 2023 20:09:55 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8D00C6EF11F54C71B2907A99139579FA Ref B: FRA31EDGE0217 Ref C: 2024-02-12T12:41:13Z
etag: "80abcdf1114da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13175

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 28ms
7ms Script
text/javascript 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 12 Feb 2024 11:48:09 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3184
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 12 Feb 2024 13:48:09 GMT

GET
H2 200 hotjar-3008912.js Show response
static.hotjar.com/c/ 9 KB
4 KB 82ms
40ms Script
application/javascript 13.224.245.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3008912.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.245.27 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-245-27.lhr62.r.cloudfront.net

Software

Resource Hash

3111a87c7971a1a82b59082326ee53b7d87d2517852205001cc36a993e9475b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Mon, 12 Feb 2024 12:40:29 GMT
via: 1.1 1b05f9178c1c0be702b00f1d1f0bcff6.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR62-C3
age: 49
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/8425516bfd9136bb12021c72b7b0cfb8
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: DphYm4-Py_ARTzrcBtvhij1-sWruErZUPpnJmMe0GBijZpASlWO2nw==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
2 KB 46ms
23ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date: Mon, 12 Feb 2024 12:41:13 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 sl.js Show response
scout-cdn.salesloft.com/ 6 KB
3 KB 98ms
17ms Script
application/javascript 2606:4700::6811:129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://scout-cdn.salesloft.com/sl.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:129 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
x-amz-version-id: 6anzvBQcvmaBDc8BSO9zI6Th.IIiwArc
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: KEADHYP9ZCZ9R3D0
age: 4816
alt-svc: h3=":443"; ma=86400
x-amz-id-2: EwylhirLpA9DI6Kq3fCLjqc/1bkW5GR8odkMlK6IpHICWvVX9IDmrw3eUwpsnLyktTXgnHxXyEU=
last-modified: Mon, 13 Dec 2021 16:28:37 GMT
server: cloudflare
etag: W/"d74cc4825c8e333b2116da3fcc649db1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8544e791a8a03a67-FRA
expires: Mon, 12 Feb 2024 16:41:13 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ 493 KB
197 KB 42ms
7ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f6743903bd9d7ad035a75142c509b67e8831a48487246272bc0751097790d6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 17:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243659
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 200774
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Feb 2025 17:00:14 GMT

GET
H2 200 sm.25.html Show response
static.addtoany.com/menu/ Frame 4028 716 B
747 B 26ms
25ms Document
text/html 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

274d4116239b63097bb7c16e56e27cbb5a77be20392fb8e2317c0a0235185cad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
age: 17109
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 8544e7913d372c2b-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 12 Feb 2024 12:41:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qe69me3o3%2FYN2uh0tKKAuqvrxWBM7JqxP5E7Gs0o89%2FU6%2BxFPhE1Hgk%2B8Gk37HH0IsxDKaQIw%2FZt8OL%2Fwq0k35SVKrDPDJ3NEYdMxGq6Wqhh37ImpjVe7PAywaA0dE0rEkNcBgxx8rbAjgMXxQFU1l0b"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 core.Ep5bSEmr.js Show response
static.addtoany.com/menu/modules/ 70 KB
26 KB 58ms
42ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

219b652de3176257072749c876811cc963494f5fbdee3f92eb38e7392f724ce0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 14233
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"a995aaed2cd978eb5749462d1dc3635e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SyGbITcD4vyvhzDjexQTU4rM2RXDgC16IKFj7VesFsTgEdCYbKe%2BppFjzfwzBTDhsAt4HH3hapm5ZaZ31ijsLHipYmqln%2By396XseQkjPCr2wfTknI6LDXN2iOgYYLTQLjODdIDt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000, immutable
cf-ray: 8544e7915bc79b63-FRA

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
209 B 14ms
14ms XHR
text/plain 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=1871943342&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&ul=en-us&de=UTF-8&dt=Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEABAAAAACAEK~&jid=2101335308&gjid=1364555873&cid=101821440.1707741673&tid=UA-203244293-1&_gid=1051841000.1707741673&_slc=1&gtm=45He4270n81T72STLDv849727317za200&cg1=blog&cg2=resources&cd2=Pageview&cd3=1707741673144.wyyij37h&cd4=2024-02-12T13%3A41%3A13.144%2B01%3A00&cd5=&cd15=matt%20lin%2C%20robert%20wallace%2C%20john%20wolfram%2C%20dimiter%20andonov%2C%20tyler%20mclellan&cd16=jan%2031%2C%202024&cd24=unknown&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&cd1=101821440.1707741673&z=799164977

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Feb 2024 12:41:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
148 B 50ms
18ms XHR
text/plain 2a00:1450:400c:c0a::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-203244293-1&cid=101821440.1707741673&jid=2101335308&gjid=1364555873&_gid=1051841000.1707741673&_u=YGBAgEABAAAAAGAEK~&z=928012342

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0a::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 12 Feb 2024 12:41:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
255 B 34ms
14ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-X6642ZTDJ7&gtm=45je4270v883779794z8849727317za200&_p=1707741673006&_gaz=1&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=101821440.1707741673&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EA&_s=1&sid=1707741673&sct=1&seg=0&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&dt=Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant&en=page_view&_fv=1&_ss=1&tfd=1474
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Feb 2024 12:41:13 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
246 B 21ms
17ms Ping
text/plain 2a00:1450:400c:c0a::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-X6642ZTDJ7&cid=101821440.1707741673&gtm=45je4270v883779794z8849727317za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l3l1&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0a::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Feb 2024 12:41:13 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 51ms
31ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-X6642ZTDJ7&cid=101821440.1707741673&gtm=45je4270v883779794z8849727317za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l3l1&npa=0&z=162228468

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Feb 2024 12:41:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1707741673221&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1707741673221&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3460746%26time%3D1707741673221%26url%3Dhttps%253A%252F%252Fwww.mandiant.com%252Fr...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1707741673221&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&cookiesTest=true&liS...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1707741673221&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&cookiesTest=true&li...

0
481 B

179ms
151ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1707741673221&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&cookiesTest=true&liSync=true&e_ipv6=AQKv8Cq_Xdv_kAAAAY2dVfmGQ-COodIUhs9UjtckEx1JiZsQ5oRiSkEGnF9oovbF_svgXB3qLi96_N3eYu3ltIzZ0V3vcg
Requested by: Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 2E3BECD534E3477D86210A3E08F58988 Ref B: FRAEDGE1315 Ref C: 2024-02-12T12:41:13Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type: application/javascript
x-li-fabric: prod-ltx1
x-cache: CONFIG_NOCACHE
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYRLpfZZmtMPDVnqMTBXg==

Redirect headers

date: Mon, 12 Feb 2024 12:41:13 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: F3E9DEC0111147398138DEC9625C1DF1 Ref B: DUS30EDGE0721 Ref C: 2024-02-12T12:41:13Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1707741673221&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&cookiesTest=true&liSync=true&e_ipv6=AQKv8Cq_Xdv_kAAAAY2dVfmGQ-COodIUhs9UjtckEx1JiZsQ5oRiSkEGnF9oovbF_svgXB3qLi96_N3eYu3ltIzZ0V3vcg
x-cache: CONFIG_NOCACHE
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYRLpfWm99t+h25Qzm/JA==

GET
H2 200 880805232811859 Show response
connect.facebook.net/signals/config/ 53 KB
11 KB 8ms
8ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/880805232811859?v=2.9.145&r=stable&domain=www.mandiant.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6049d6ded04c7863dd3dbc4cfef6c74868f0ed4a45df4eb2daf68a3d3e0b174d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 12 Feb 2024 12:41:13 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 11060
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: J90UfIa8blQqKK5CZNKHYKcjO2nquhCEJr09NVt6ynNadgSFEcUJEZ5+fc19mpjQPjbLdrqt2RBWmRpO0wNWAg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 8ms
7ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date: Mon, 12 Feb 2024 12:41:13 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Wed, 22 May 2024 12:41:13 GMT

GET
H2 200 adsct
t.co/i/ 43 B
378 B 202ms
183ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=c5ec6b2f-fa42-4d3b-8953-e95fbe3393a2&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1692d7c9-9a89-4ac4-b1d9-63c0f9dab9cf&tw_document_href=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o5b0k&type=javascript&version=2.3.29

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-response-time: 176
date: Mon, 12 Feb 2024 12:41:13 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: f83119bc842117df
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: df9ea796c0fc195d7dd6ffb3007478ca4c6f9679943717af8e8f60ebce95624a
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
395 B 130ms
110ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=c5ec6b2f-fa42-4d3b-8953-e95fbe3393a2&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1692d7c9-9a89-4ac4-b1d9-63c0f9dab9cf&tw_document_href=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o5b0k&type=javascript&version=2.3.29

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-response-time: 103
date: Mon, 12 Feb 2024 12:41:12 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 19434d6a33f7526e
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: e987da3a206aba361ccd4196dcdce749a3c3f5b0a1e0b7fe904d3ff88f78f544
content-length: 43

GET
H2 204 5870833.js Show response
bat.bing.com/p/action/ 0
118 B 39ms
39ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5870833.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Mon, 12 Feb 2024 12:41:12 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BC721CD7CEDE4ABFB14B6B5F29A7A33F Ref B: FRA31EDGE0217 Ref C: 2024-02-12T12:41:13Z
x-cache: CONFIG_NOCACHE

GET
H2 200 modules.8414bbb3c65a3c228a5a.js Show response
script.hotjar.com/ 218 KB
55 KB 46ms
13ms Script
application/javascript 99.84.88.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.8414bbb3c65a3c228a5a.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3008912.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.88.30 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-88-30.muc50.r.cloudfront.net

Software

Resource Hash

290f298e1bb2bdcb4feccae77ba34dbc0cdccadbbcfa8489d758edb282bd1f31

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 12:50:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 ea6cdb5ba8bfb6f6aa18ec6651e5bc42.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-C1
age: 258667
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55350
last-modified: Fri, 09 Feb 2024 12:49:54 GMT
etag: "a7ea8f13d71da1eabb486d86cde54573"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: bOM5aGj7UWKWiz8EpUFJZMVzOpsVrh4ejCf3K7EgOlKu1t1_L2qNTw==

POST
H/1.1 200
OK visitWebPage
565-pei-952.mktoresp.com/webevents/ 2 B
318 B 672ms
95ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://565-pei-952.mktoresp.com/webevents/visitWebPage?_mchNc=1707741673252&_mchCn=&_mchId=565-PEI-952&_mchTk=_mch-mandiant.com-1707741673252-51035&_mchHo=www.mandiant.com&_mchPo=&_mchRu=%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date: Mon, 12 Feb 2024 12:41:13 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: ef5281d7-babe-4255-8fba-0827f7dc9813

GET
H2 200 r Show response
scout.salesloft.com/ 41 B
358 B 302ms
95ms XHR
application/json 52.22.223.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/r?tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0IjoxMDUwMDl9.GHpZgHyRyFl9iN7anlcbMbmW3chPCQZrSX98AJ7UjM8

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.22.223.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-223-182.compute-1.amazonaws.com

Software

Resource Hash

1cfea949b0b2925d27b84d56d18f2ea1c6b948fdf3ae95c534a14706043da178

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mandiant.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 41
x-request-id: c711b9a977c8d3c473bd2c887c37df1f

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 21ms
7ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=880805232811859&ev=PageView&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&rl=&if=false&ts=1707741673257&sw=1600&sh=1200&v=2.9.145&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4125&fbp=fb.1.1707741673256.658132875&ler=empty&cdl=API_unavailable&it=1707741673229&coo=false&tm=1&exp=e1&rqm=GET

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 12 Feb 2024 12:41:13 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 PTMono-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/ 71 KB
71 KB 420ms
420ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/PTMono-Regular.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 86802
date: Mon, 12 Feb 2024 12:41:13 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 72380
x-request-id: v-debafd40-c0ea-11ee-801a-eb8a00f47ee2
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e792e8625b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 974.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 11 KB
3 KB 415ms
414ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/974.bundle.js?ed9f0d

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_3j24uFU9OMU68V7podrhLUkKysvljLnYFg9cxMvqtJc.js?scope=footer&delta=4&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

201492c149f68b701455a2d046549a318a76ed5bca4ab13ebd913dbd14710246

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 75118
date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 3375
x-request-id: v-e019f1be-c0ea-11ee-9a46-c36ec5f66e6c
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e79318755b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 200 404.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 406 B
409 B 406ms
405ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/404.bundle.js?2c5f80

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 74880
date: Mon, 12 Feb 2024 12:41:13 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 263
x-request-id: v-e024ce90-c0ea-11ee-a6d7-d341495819a8
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e79318765b8c-FRA
expires: Mon, 26 Feb 2024 12:41:13 GMT

GET
H2 204 0
bat.bing.com/action/ 0
287 B 33ms
33ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5870833&tm=gtm002&Ver=2&mid=6361fd92-8d29-4a7c-873b-0d61f505c68c&sid=01b3a4b0c9a411ee9dbf2b247301431c&vid=01b395c0c9a411ee9c8de729a536c532&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Cutting%20Edge,%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant&p=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&r=&lt=1794&evt=pageLoad&sv=1&rn=676449

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Feb 2024 12:41:13 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D19F06485E554DA495740A0C98F89E7E Ref B: FRA31EDGE0217 Ref C: 2024-02-12T12:41:13Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 i Show response
scout.salesloft.com/ 48 B
465 B 96ms
95ms XHR
application/json 52.22.223.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/i

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.22.223.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-223-182.compute-1.amazonaws.com

Software

Resource Hash

782b60b371309c79527293491f8188372c9c327fa392d824248876bbee32fb75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mandiant.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 48
x-request-id: 6997217657160b2c191ba0f977d7fe52

GET
H2 200 Barlow-SemiBold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 56 KB
57 KB 419ms
418ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-SemiBold.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 74905
date: Mon, 12 Feb 2024 12:41:14 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 57764
x-request-id: v-dbe626da-c0ea-11ee-a136-c71ffcd08ae9
last-modified: Wed, 26 Oct 2022 19:35:15 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e79599d35b8c-FRA
expires: Mon, 26 Feb 2024 12:41:14 GMT

GET
H2 200 Barlow-Medium.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 55 KB
55 KB 402ms
401ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Medium.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 67612
date: Mon, 12 Feb 2024 12:41:14 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 55968
x-request-id: v-dbe50f8e-c0ea-11ee-bb35-d724ff51d957
last-modified: Wed, 26 Oct 2022 19:55:35 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e79599d55b8c-FRA
expires: Mon, 26 Feb 2024 12:41:14 GMT

GET
H2 200 Barlow-MediumItalic.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 59 KB
59 KB 432ms
431ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-MediumItalic.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

34e89fde702aa592d82afbb8d98034150cb3a2e6bd67a922af1edd106cf87fe8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_8vrLgUkvp_r1uOxgkHgKbdM6PHIJHr0VV6lYzJ3gN24.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUFuOwzAIvJBbjmQRjFNvbBMBaZTbr7OPbqXsDxoGmBmRRZuX1SD_gIApuWA_4Bfcs0r3QJu5tNg4FYT3JpJZsMOcG0xoHBr2QXeP_uDGMPchfTM_Ktv_s48L_2T1QlhvjpMFWoaPi0YkEk1FOrzQdzru6U9CmXB1eiC8UCxjZ1b0cfHmtTMuBg11YZd4vuAyXFVmZbM4oYaKh2weUzGSEfEA6UxSQy7VWeE0Ow2ehXeDr3pvkrbKF9m5XHPsRTkrNv4EAfegTg
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-cache-hits: 55761
date: Mon, 12 Feb 2024 12:41:14 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 60612
x-request-id: v-dbe5adea-c0ea-11ee-b476-6b96bdb7dac8
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 8544e795a9d65b8c-FRA
expires: Mon, 26 Feb 2024 12:41:14 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
198 B 165ms
165ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.mandiant.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 12 Feb 2024 12:41:13 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: F131FB9467BD4A87B8C2087724242ED6 Ref B: DUS30EDGE0721 Ref C: 2024-02-12T12:41:14Z
linkedin-action: 1
vary: Origin
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-ltx1
access-control-allow-origin: https://www.mandiant.com
x-cache: CONFIG_NOCACHE
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYRLpfbz0YMGi74Yk6oyQ==

GET
H2 200 nr-rum-1.251.1.min.js Show response
js-agent.newrelic.com/ 45 KB
16 KB 29ms
6ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-rum-1.251.1.min.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

f121cf1df97627fbe5ea62afd38f47a9db948b87c4d0a1a4a841d849b006cd0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-amz-version-id: buLfX9A7mQXpuLHozq55E4VjWIqJuIHo
content-encoding: br
via: 1.1 varnish
date: Mon, 12 Feb 2024 12:41:14 GMT
strict-transport-security: max-age=300
x-amz-request-id: XPFTGYHVHNGW3NH7
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 15811
x-amz-id-2: iOOQ2DBy6PloS548EEu9/TlWpBW8TTEEQ1SZWzzMxxHiKaVm+bwwqqF2puWRsLpI7JW3cf2nYx0=
x-served-by: cache-fra-etou8220096-FRA
last-modified: Mon, 29 Jan 2024 21:25:17 GMT
server: AmazonS3
x-timer: S1707741674.327739,VS0,VE0
etag: "c466cf97c933f9844290e9463a553cc4"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 240461

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
17 KB 41ms
8ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Feb 2024 12:41:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 20 Dec 2023 22:26:49 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65836a29-fee9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17567
expires: Mon, 12 Feb 2024 12:41:14 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1871943342&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&ul=en-us&de=UTF-8&dt=Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Resource%20Type&ea=blog&el=Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation&_u=aGDAgEABAAAAAGAEK~&jid=&gjid=&cid=101821440.1707741673&tid=UA-203244293-1&_gid=1051841000.1707741673&gtm=45He4270n81T72STLDv849727317za200&cg1=blog&cg2=resources&cd3=1707741674312.zriw4jx7&cd4=2024-02-12T13%3A41%3A14.312%2B01%3A00&cd5=&cd15=matt%20lin%2C%20robert%20wallace%2C%20john%20wolfram%2C%20dimiter%20andonov%2C%20tyler%20mclellan&cd16=jan%2031%2C%202024&cd24=unknown&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&cd1=101821440.1707741673&z=433789877

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 11 Feb 2024 17:25:11 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 69363
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200 NRJS-890ead692fb1e944fb6 Show response
bam.nr-data.net/1/ 40 B
404 B 278ms
241ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-890ead692fb1e944fb6?a=1404479750&v=1.251.1&to=YlRVYERZV0ZSWhINX1sedldCUVZbHH0UEUBUXWtaWVxcaXBWCBBCWl1bUURkd1pXXDANVUJyWFpCSlZZX1wUSQ5DWFJD&rst=2610&ck=0&s=6531e101df8a9a3d&ref=https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation&hr=0&qt=5&ap=1227&be=473&fe=2090&dc=1321&at=ThNWFgxDREg%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1707741671741,%22n%22:0,%22dn%22:13,%22dne%22:13,%22c%22:13,%22s%22:20,%22ce%22:32,%22rq%22:32,%22rp%22:474,%22rpe%22:480,%22di%22:1788,%22ds%22:1788,%22de%22:1794,%22dc%22:2561,%22l%22:2561,%22le%22:2563%7D,%22navigation%22:%7B%7D%7D&fp=1344&fcp=1344
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-rum-1.251.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 5ca742541d65d718402499ed1d84d003258ce2116562169b85744cf7d798485a

Request headers

Referer: https://www.mandiant.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 12 Feb 2024 12:41:14 GMT
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 40
x-served-by: cache-fra-eddf8230076-FRA

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 14ms
6ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:14 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.mandiant.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 36 B
337 B 45ms
8ms XHR
text/html 2a02:26f0:ab00::214:8e70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 987e5a2903b469be1de780b5170fcf1bcd0178c3e26c90f9a1b86c46557a83ac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Feb 2024 12:41:14 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.mandiant.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a02:6ea0:c71b:0:1012:c3d6:9be7:71f0
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1707741674389_34901612_540986414_29_920_5_14_219";dur=1
content-length: 36
expires: Mon, 12 Feb 2024 12:41:14 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 196ms
188ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=66753b89-d9e0-4033-889d-3ea74d7cecc2&session=85ed44a5-0def-4edf-8caa-b04a849a44a2&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2012%20Feb%202024%2012%3A41%3A14%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&pageViewId=67e2891c-8a72-43ab-88af-6a416553af17&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:14 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 191ms
183ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=66753b89-d9e0-4033-889d-3ea74d7cecc2&session=85ed44a5-0def-4edf-8caa-b04a849a44a2&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2012%20Feb%202024%2012%3A41%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22627b22264f359a2be8e661bd05849ae6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2012%20Feb%202024%2012%3A41%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2012%20Feb%202024%2012%3A41%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2012%20Feb%202024%2012%3A41%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&pageViewId=67e2891c-8a72-43ab-88af-6a416553af17&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:14 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 185ms
185ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=66753b89-d9e0-4033-889d-3ea74d7cecc2&session=85ed44a5-0def-4edf-8caa-b04a849a44a2&event=ipv6&q=%7B%22address%22%3A%222a02%3A6ea0%3Ac71b%3A0%3A1012%3Ac3d6%3A9be7%3A71f0%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&pageViewId=67e2891c-8a72-43ab-88af-6a416553af17&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:14 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 193ms
193ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=66753b89-d9e0-4033-889d-3ea74d7cecc2&session=85ed44a5-0def-4edf-8caa-b04a849a44a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2012%20Feb%202024%2012%3A41%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2012%20Feb%202024%2012%3A41%3A14%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&pageViewId=67e2891c-8a72-43ab-88af-6a416553af17&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:15 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 51D7 46 KB
29 KB 40ms
39ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=normal&cb=ixb1eexgxwj8

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f82785f8c97dea40084a63d7202e524d3305ef08b0d7b89c8636b5c026f79f58

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WMO6FB_mGBF20n2caDvIrg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-WMO6FB_mGBF20n2caDvIrg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 12 Feb 2024 12:41:15 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 5A1F 46 KB
29 KB 32ms
31ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=compact&cb=jlydal65l5aw

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

228e4f0eacf07e638f77759839cf5379d35886f02cd68c043173ebb356ea60b6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-FgMWj4iQjC7PiHX-i6dDtQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-FgMWj4iQjC7PiHX-i6dDtQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 12 Feb 2024 12:41:15 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame 5A1F 55 KB
24 KB 20ms
7ms Stylesheet
text/css 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=compact&cb=jlydal65l5aw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 09:58:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9749
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Feb 2025 09:58:46 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame 5A1F 493 KB
196 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f6743903bd9d7ad035a75142c509b67e8831a48487246272bc0751097790d6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 17:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243661
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 200774
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Feb 2025 17:00:14 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame 51D7 55 KB
24 KB 18ms
10ms Stylesheet
text/css 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 09:58:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9749
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Feb 2025 09:58:46 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame 51D7 493 KB
196 KB 26ms
17ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f6743903bd9d7ad035a75142c509b67e8831a48487246272bc0751097790d6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 17:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243661
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 200774
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Feb 2025 17:00:14 GMT

GET
H3 200 NJoY_V4jI6PkkmceXDBS3pUujDrlmaNXUDelo4JV6T4.js Show response
www.google.com/js/bg/ Frame 51D7 17 KB
7 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/NJoY_V4jI6PkkmceXDBS3pUujDrlmaNXUDelo4JV6T4.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

349a18fd5e2323a3e492671e5c3052de952e8c3ae599a3575037a5a38255e93e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=normal&cb=ixb1eexgxwj8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 21:49:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 226278
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6860
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 10:00:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Feb 2025 21:49:57 GMT

GET
H3 200 NJoY_V4jI6PkkmceXDBS3pUujDrlmaNXUDelo4JV6T4.js Show response
www.google.com/js/bg/ Frame 5A1F 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/NJoY_V4jI6PkkmceXDBS3pUujDrlmaNXUDelo4JV6T4.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

349a18fd5e2323a3e492671e5c3052de952e8c3ae599a3575037a5a38255e93e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=compact&cb=jlydal65l5aw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 21:49:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 226278
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6860
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 10:00:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Feb 2025 21:49:57 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 51D7 102 B
135 B 15ms
15ms Other
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

da38d3e3b25f4bd39761adb2517f234e1b291293d6582e7c58ea5b335f205f38

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=normal&cb=ixb1eexgxwj8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Mon, 12 Feb 2024 12:41:15 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 5A1F 102 B
135 B 19ms
19ms Other
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

da38d3e3b25f4bd39761adb2517f234e1b291293d6582e7c58ea5b335f205f38

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=compact&cb=jlydal65l5aw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Mon, 12 Feb 2024 12:41:15 GMT

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 9C68 7 KB
1 KB 19ms
18ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

461647961c751b29cabbbbaeaae4ddc12feecb486c72553d8f22761e4551e98b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3qNOoyhPxbHI1jQdmPGz7Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-3qNOoyhPxbHI1jQdmPGz7Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 12 Feb 2024 12:41:15 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 17F4 7 KB
1 KB 20ms
20ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

501ff93c3a5314073000a2baa014d6f907b090e006e6e904c2fc6d0d86e95c49

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6HDqJ_qQzoMe_fkE0mUoRA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-6HDqJ_qQzoMe_fkE0mUoRA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 12 Feb 2024 12:41:15 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame 9C68 55 KB
24 KB 6ms
6ms Stylesheet
text/css 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 09:58:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9749
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Feb 2025 09:58:46 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame 9C68 493 KB
196 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f6743903bd9d7ad035a75142c509b67e8831a48487246272bc0751097790d6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 17:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243661
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 200774
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Feb 2025 17:00:14 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame 17F4 55 KB
24 KB 6ms
6ms Stylesheet
text/css 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 09:58:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9749
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Feb 2025 09:58:46 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame 17F4 493 KB
196 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f6743903bd9d7ad035a75142c509b67e8831a48487246272bc0751097790d6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 17:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243661
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 200774
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Feb 2025 17:00:14 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 183ms
183ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=66753b89-d9e0-4033-889d-3ea74d7cecc2&session=85ed44a5-0def-4edf-8caa-b04a849a44a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2012%20Feb%202024%2012%3A41%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2012%20Feb%202024%2012%3A41%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&pageViewId=67e2891c-8a72-43ab-88af-6a416553af17&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:16 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 221ms
221ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=66753b89-d9e0-4033-889d-3ea74d7cecc2&session=85ed44a5-0def-4edf-8caa-b04a849a44a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2012%20Feb%202024%2012%3A41%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2012%20Feb%202024%2012%3A41%3A16%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&pageViewId=67e2891c-8a72-43ab-88af-6a416553af17&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 12:41:17 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=66753b89-d9e0-4033-889d-3ea74d7cecc2&session=85ed44a5-0def-4edf-8caa-b04a849a44a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2012%20Feb%202024%2012%3A41%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2012%20Feb%202024%2012%3A41%3A17%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224004%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cutting%20Edge%2C%20Part%202%3A%20Investigating%20Ivanti%20Connect%20Secure%20VPN%20Zero-Day%20Exploitation%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-day-exploitation&pageViewId=67e2891c-8a72-43ab-88af-6a416553af17&v=1.1.14

Verdicts & Comments Add Verdict or Comment

80 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

28 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mandiant.com/	1970-01-20 18:22:23	Name: __cf_bm Value: 9J9hxuwm.61gsQ96okGhV26vRZsO5rJ1kmDYMw4K0ww-1707741672-1-AaVVOD3yUUtEvmVaHCaIhQFPIW4ckm7GihyawulZGN9CTJrKwUTO1OhXkvL3zU5CrVYPjwzY3a+JcmxGLKyw+2g=
.mandiant.com/	1970-01-20 20:31:57	Name: _gcl_au Value: 1.1.445919290.1707741673
.mandiant.com/	1970-01-20 18:23:48	Name: _gid Value: GA1.2.1051841000.1707741673
.mandiant.com/	1970-01-20 18:22:21	Name: _dc_gtm_UA-203244293-1 Value: 1
.mandiant.com/	1970-01-21 03:58:21	Name: _mkto_trk Value: id:565-PEI-952&token:_mch-mandiant.com-1707741673252-51035
.mandiant.com/	1970-01-20 20:31:57	Name: _fbp Value: fb.1.1707741673256.658132875
.twitter.com/	1970-01-21 03:58:21	Name: personalization_id Value: "v1_D0Tk9ZUKjTObYF0zAOu2yw=="
.linkedin.com/	1970-01-20 20:31:57	Name: li_sugr Value: ac408ac8-dae0-4c1f-a2f2-68cbced28b8b
.linkedin.com/	1970-01-21 03:07:57	Name: bcookie Value: "v=2&1b649302-37b6-4f62-8fc3-d8a3853d6420"
.linkedin.com/	1970-01-20 18:23:48	Name: lidc Value: "b=TGST02:s=T:r=T:a=T:p=T:g=3189:u=1:x=1:i=1707741673:t=1707828073:v=2:sig=AQGHbG1V6tsLNL-7a5y6gsqQ2V0D32X7"
.t.co/	1970-01-21 03:58:21	Name: muc_ads Value: e1dd74e7-1b92-4b01-b822-0852c0967507
.mandiant.com/	1970-01-21 03:07:57	Name: _hjSessionUser_3008912 Value: eyJpZCI6IjY2MjYxNjExLWIzN2QtNTgwYS1hMWM0LWE3NWM1NmM5OTc2MiIsImNyZWF0ZWQiOjE3MDc3NDE2NzM1MzQsImV4aXN0aW5nIjpmYWxzZX0=
.mandiant.com/	1970-01-20 18:22:23	Name: _hjSession_3008912 Value: eyJpZCI6IjU5YjA3MTU4LWUyNzItNDE4Ny04N2FjLTk3NDhlNzMyZGM4ZCIsImMiOjE3MDc3NDE2NzM1MzQsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.mandiant.com/	1970-01-20 18:23:48	Name: _uetsid Value: 01b3a4b0c9a411ee9dbf2b247301431c
.mandiant.com/	1970-01-21 03:43:57	Name: _uetvid Value: 01b395c0c9a411ee9c8de729a536c532
www.mandiant.com/	1970-01-20 18:32:26	Name: slireg Value: https://scout.us3.salesloft.com
.linkedin.com/	1970-01-20 19:05:33	Name: UserMatchHistory Value: AQLnlKfGYhn25QAAAY2dVfgJSxCpD-KVMd1ZqetRRnAkSto7AR3JaW6f24_V9nLHXzMkPvYLIguZkg
.linkedin.com/	1970-01-20 19:05:33	Name: AnalyticsSyncHistory Value: AQK549lFdVErQwAAAY2dVfgJ7MBR1nGcXs3rUgPuZZgrO3-gMKIzP0HbLQSoZe-u4gSb7E5I3K9dXvn-VbEiNg
.bing.com/	1970-01-21 03:43:57	Name: MUID Value: 17AC3C4C4FA46DCC16AB286F4E2F6C8F
www.mandiant.com/	1970-01-21 03:07:57	Name: sliguid Value: 91a8714e-2379-43d5-b3aa-f91594a66941
www.mandiant.com/	1970-01-21 03:07:57	Name: slirequested Value: true
.www.linkedin.com/	1970-01-21 03:07:57	Name: bscookie Value: "v=1&20240212124113de16d424-ac81-4e82-8a8b-267b6230d061AQHoXfIJhXAHQfGs_1b6sv6dW4ypIVUE"
.linkedin.com/	1970-01-20 22:41:33	Name: li_gc Value: MTswOzE3MDc3NDE2NzM7MjswMjEYvKnG+9aG+gTAdZtjaVBeiBL70qKT7O1EGPAOEOrAAw==
.mandiant.com/	1970-01-21 03:58:21	Name: _ga Value: GA1.2.101821440.1707741673
.mandiant.com/	1970-01-21 03:58:21	Name: _ga_X6642ZTDJ7 Value: GS1.1.1707741673.1.0.1707741674.59.0.0
www.mandiant.com/	1970-01-21 03:58:21	Name: _gd_visitor Value: 66753b89-d9e0-4033-889d-3ea74d7cecc2
www.mandiant.com/	1970-01-20 18:22:36	Name: _gd_session Value: 85ed44a5-0def-4edf-8caa-b04a849a44a2
.6sc.co/	1970-01-21 03:58:21	Name: 6suuid Value: b4641102779a1900ea11ca6553020000b0bc0d00

50 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://connect.facebook.net/signals/config/880805232811859?v=2.9.145&r=stable&domain=www.mandiant.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100(Line 95) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

565-pei-952.mktoresp.com
analytics.twitter.com
b.6sc.co
bam.nr-data.net
bat.bing.com
c.6sc.co
cdn4.iconfinder.com
cdnjs.cloudflare.com
connect.facebook.net
ipv6.6sc.co
j.6sc.co
js-agent.newrelic.com
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
scout-cdn.salesloft.com
scout.salesloft.com
script.hotjar.com
snap.licdn.com
static.addtoany.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.mandiant.com
b.6sc.co
104.244.42.195
104.244.42.5
13.107.42.14
13.224.245.27
151.101.2.137
162.247.243.29
192.28.144.124
199.232.188.157
2.17.100.184
2001:4860:4802:34::36
2001:4860:4802:36::178
2606:4700:10::6816:47c5
2606:4700:300b::a29f:f17d
2606:4700:3108::ac42:292d
2606:4700::6811:129
2606:4700::6811:190e
2620:1ec:21::14
2620:1ec:22::14
2620:1ec:c11::200
2a00:1450:4001:811::2008
2a00:1450:4001:827::2003
2a00:1450:4001:82a::2003
2a00:1450:4001:830::2004
2a00:1450:400c:c0a::9d
2a02:26f0:3500:16::215:1496
2a02:26f0:ab00::214:8e70
2a03:2880:f084:105:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
52.22.223.182
88.221.60.75
99.84.88.30
0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4
0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379
143f4d7f6d2c5abca7590a6dec282876ef49bc849c886fc7eefbfe3e1c6706fd
1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d
1cfea949b0b2925d27b84d56d18f2ea1c6b948fdf3ae95c534a14706043da178
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1e44b7039bdfb7c21f22c9c68dc18d01b6db90860e556ac1781f5c1f50940a58
201492c149f68b701455a2d046549a318a76ed5bca4ab13ebd913dbd14710246
219b652de3176257072749c876811cc963494f5fbdee3f92eb38e7392f724ce0
228e4f0eacf07e638f77759839cf5379d35886f02cd68c043173ebb356ea60b6
274d4116239b63097bb7c16e56e27cbb5a77be20392fb8e2317c0a0235185cad
290f298e1bb2bdcb4feccae77ba34dbc0cdccadbbcfa8489d758edb282bd1f31
2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf
2f76ce833f021609c95e4f7aa037a19cfb33bcfe5dd6e25ead5b6fb61add6050
3111a87c7971a1a82b59082326ee53b7d87d2517852205001cc36a993e9475b9
3245f6cb8d40eebea048a60b056d9a48cbc3e1b0309a0a4cb0e51280f6b0c712
325d8189deb081774080e392822404a86c041898c0cfeee7357b828cf9e3c402
349a18fd5e2323a3e492671e5c3052de952e8c3ae599a3575037a5a38255e93e
34e89fde702aa592d82afbb8d98034150cb3a2e6bd67a922af1edd106cf87fe8
461647961c751b29cabbbbaeaae4ddc12feecb486c72553d8f22761e4551e98b
4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440
4ad97474c633fd0ce7bfb7934ac7947ef210c58ac3ae66fd6785f6b211fec885
4b37bfa474106bcdd85a364261bc9d4458ee55d670a08bf76fa61ea1596ea7ed
4fa7ca84dc3a040c7199206d3554b4b57d6cbb5c49ef435f674103587640d26a
501ff93c3a5314073000a2baa014d6f907b090e006e6e904c2fc6d0d86e95c49
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5ca742541d65d718402499ed1d84d003258ce2116562169b85744cf7d798485a
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
5f6743903bd9d7ad035a75142c509b67e8831a48487246272bc0751097790d6b
6049d6ded04c7863dd3dbc4cfef6c74868f0ed4a45df4eb2daf68a3d3e0b174d
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621
7762b4265e6050c33745fd1fae5110f9f265564f0a85d9ac01efaa65029db59c
782b60b371309c79527293491f8188372c9c327fa392d824248876bbee32fb75
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
789a132a2a269c0b47e3df2e1b3080cc7afaf36a2239d99effe7f6df5d8acfce
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8a3d8c061a2a585985a71d5b1a45c424c5bc79b310c86b4731b5bececf5ea5df
9635aa800a995e86f3894d9a6fd5f530ae00da2937442f0795ae213b42782ba8
987e5a2903b469be1de780b5170fcf1bcd0178c3e26c90f9a1b86c46557a83ac
9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e
a4437ac3034c29f937cc15fc401fe5aeef7b4a6df042b8de0ddad795fff3f8d9
a8e5cd4fe515c0e6afe5713bb0bb7494d7e6106e1a23cb4d6a430f13aabed6e1
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acb33e5d72259c82bef8f6d6ddfc56bbdf4130739d3271a437b4d0065c390d9a
b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24
b5474d3ed408366dcebededf5c987f44b43b389137272c282c6c972852a14fc0
bca51ed2fe251488a1b150edf560d43880f1486740f34d24120ede486f99676b
ce56dc3783735b873af61135d410e3ccec9dfd565a5961fd707e85d1d6b654af
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
cfbbb6a8bb9482b6bddbba133d70d9ac28fea886ede20ecdaf3110d5c70dba6c
da38d3e3b25f4bd39761adb2517f234e1b291293d6582e7c58ea5b335f205f38
db8889219047b9dab1299759fc44d56af45ee4e683961df1d54d1f0ef783690a
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9474894bf64b11c40884f83b0ba6888635bf90bfaae11db1944d99771f1c820
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f121cf1df97627fbe5ea62afd38f47a9db948b87c4d0a1a4a841d849b006cd0d
f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f
f82785f8c97dea40084a63d7202e524d3305ef08b0d7b89c8636b5c026f79f58
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6
ff46ab88d5fe2880ee24e0a56c4f423096ea4eb7b80e0fc8032319e26b5a002b

www.mandiant.com Open in urlscan Pro 2606:4700:300b::a29f:f17d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

90 Requests

98 %HTTPS

61 %IPv6

25 Domains

33 Subdomains

31 IPs

3 Countries

3120 kBTransfer

7070 kBSize

28 Cookies

32 Outgoing links

Redirected requests

90 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.mandiant.com Open in urlscan Pro
2606:4700:300b::a29f:f17d Public Scan

Screenshot
Live screenshot

Full Image

90
Requests

98 %
HTTPS

61 %
IPv6

25
Domains

33
Subdomains

31
IPs

3
Countries

3120 kB
Transfer

7070 kB
Size

28
Cookies

90 HTTP transactions
0 data transactions