www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1702:852f:d87f:6683:b05a Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Submission: On October 15 via api (October 15th 2024, 2:11:51 pm UTC) from IN — Scanned from CA

Summary HTTP 216 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 59 IPs in 2 countries across 45 domains to perform 216 HTTP transactions. The main IP is 2600:1f18:1492:1702:852f:d87f:6683:b05a, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 120260.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 16th 2024. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
67	2600:1f18:149... 2600:1f18:1492:1702:852f:d87f:6683:b05a	14618 (AMAZON-AES) (AMAZON-AES)
6	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
23	2600:141b:1c0... 2600:141b:1c00:209a::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 4	18.209.0.122 18.209.0.122	14618 (AMAZON-AES) (AMAZON-AES)
1	34.235.33.249 34.235.33.249	14618 (AMAZON-AES) (AMAZON-AES)
1 1	18.209.125.30 18.209.125.30	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.39.93 63.140.39.93	14618 (AMAZON-AES) (AMAZON-AES)
4	104.19.148.8 104.19.148.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	23.34.59.33 23.34.59.33	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.51.57.192 23.51.57.192	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.86.70.109 34.86.70.109	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2607:f8b0:400... 2607:f8b0:4006:80c::2008	15169 (GOOGLE) (GOOGLE)
2	64.202.112.191 64.202.112.191	23352 (SERVERCEN...) (SERVERCENTRAL)
1	2600:141b:1c0... 2600:141b:1c00:2e::17d1:48c5	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	142.250.80.104 142.250.80.104	15169 (GOOGLE) (GOOGLE)
4	142.250.64.68 142.250.64.68	15169 (GOOGLE) (GOOGLE)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:32::178	15169 (GOOGLE) (GOOGLE)
2	2a02:6ea0:c45... 2a02:6ea0:c454::1	60068 (CDN77 _) (CDN77 _)
3	142.251.40.98 142.251.40.98	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4006:80c::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.65.230 142.250.65.230	15169 (GOOGLE) (GOOGLE)
2	3.135.83.200 3.135.83.200	16509 (AMAZON-02) (AMAZON-02)
3	142.250.64.99 142.250.64.99	15169 (GOOGLE) (GOOGLE)
1	2606:4700:310... 2606:4700:3108::ac42:2af8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.32.164.86 52.32.164.86	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:29:1... 2620:1ec:29:1::35	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	74.121.140.211 74.121.140.211	30419 (PAEDAE-INC) (PAEDAE-INC)
1	52.7.151.245 52.7.151.245	14618 (AMAZON-AES) (AMAZON-AES)
1	146.75.28.157 146.75.28.157	54113 (FASTLY) (FASTLY)
1	2600:141b:1c0... 2600:141b:1c00:6::17df:d120	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	34.196.140.205 34.196.140.205	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:251... 2600:9000:2512:7400:12:dfa9:e200:93a1	16509 (AMAZON-02) (AMAZON-02)
2 3	68.67.160.137 68.67.160.137	29990 (ASN-APPNEX) (ASN-APPNEX)
3 4	68.67.161.208 68.67.161.208	29990 (ASN-APPNEX) (ASN-APPNEX)
1	63.140.39.65 63.140.39.65	14618 (AMAZON-AES) (AMAZON-AES)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	172.66.0.227 172.66.0.227	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	52.22.50.55 52.22.50.55	14618 (AMAZON-AES) (AMAZON-AES)
1	2a04:4e42:200... 2a04:4e42:200::485	54113 (FASTLY) (FASTLY)
2	44.226.187.177 44.226.187.177	16509 (AMAZON-02) (AMAZON-02)
1 2	172.217.165.134 172.217.165.134	15169 (GOOGLE) (GOOGLE)
2	157.240.241.1 157.240.241.1	32934 (FACEBOOK) (FACEBOOK)
1	172.67.163.237 172.67.163.237	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 6	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.94.188.245 3.94.188.245	14618 (AMAZON-AES) (AMAZON-AES)
1	54.203.236.163 54.203.236.163	16509 (AMAZON-02) (AMAZON-02)
2 2	35.244.154.8 35.244.154.8	15169 (GOOGLE) (GOOGLE)
8 9	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2 3	18.214.54.215 18.214.54.215	14618 (AMAZON-AES) (AMAZON-AES)
2	44.235.191.156 44.235.191.156	16509 (AMAZON-02) (AMAZON-02)
1	35.81.162.201 35.81.162.201	16509 (AMAZON-02) (AMAZON-02)
1	44.225.29.129 44.225.29.129	16509 (AMAZON-02) (AMAZON-02)
1 1	142.251.40.226 142.251.40.226	15169 (GOOGLE) (GOOGLE)
1 1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
3 3	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
216	59

67 2600:1f18:1492:1702:852f:d87f:6683:b05a (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2600:141b:1c00:209a::1e80 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.209.0.122 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-209-0-122.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.235.33.249 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-235-33-249.compute-1.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.209.125.30 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-209-125-30.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.93 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-93.data.adobedc.net

fortinet.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.19.148.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 23.34.59.33 (Edison, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-34-59-33.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.51.57.192 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-51-57-192.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wave.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.86.70.109 (Washington, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 109.70.86.34.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80c::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.202.112.191 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:2e::17d1:48c5 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.80.104 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s36-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.64.68 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s30-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:6ea0:c454::1 (New York, United States)

ASN60068 (CDN77 _, GB)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.40.98 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s79-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:80c::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.65.230 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.135.83.200 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-135-83-200.us-east-2.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.64.99 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s31-in-f3.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:2af8 (United States)

ASN13335 (CLOUDFLARENET, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1247 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.32.164.86 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-164-86.us-west-2.compute.amazonaws.com

abm-tracking.demandscience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:29:1::35 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

tmp.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixels.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
webtracker.argusplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.121.140.211 (Reston, United States)

ASN30419 (PAEDAE-INC, US)

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.7.151.245 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-7-151-245.compute-1.amazonaws.com

dx.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.28.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:6::17df:d120 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.196.140.205 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-140-205.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2512:7400:12:dfa9:e200:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.inzynk.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.67.160.137 (Colonia, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.161.208 (Colonia, United States) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.65 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-65.data.adobedc.net

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.66.0.227 (United States)

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.22.50.55 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-50-55.compute-1.amazonaws.com

52.22.50.55	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.226.187.177 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-226-187-177.us-west-2.compute.amazonaws.com

intentstream.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.165.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lax30s03-in-f6.1e100.net

10104846.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.241.1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-lga3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.163.237 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.117.77.79 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.94.188.245 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-94-188-245.compute-1.amazonaws.com

6033413.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.203.236.163 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-236-163.us-west-2.compute.amazonaws.com

tracking.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 52.223.40.198 (United States) 8 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.214.54.215 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-214-54-215.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.235.191.156 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-235-191-156.us-west-2.compute.amazonaws.com

px.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.81.162.201 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-81-162-201.us-west-2.compute.amazonaws.com

gs.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.225.29.129 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-225-29-129.us-west-2.compute.amazonaws.com

px.steelhousemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.226 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.111.113.62 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
68	fortinet.com www.fortinet.com — Cisco Umbrella Rank: 120260 metrics.fortinet.com — Cisco Umbrella Rank: 303802	5 MB
23	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 430	152 KB
14	6sc.co j.6sc.co — Cisco Umbrella Rank: 5626 c.6sc.co — Cisco Umbrella Rank: 6951 ipv6.6sc.co — Cisco Umbrella Rank: 5794 b.6sc.co — Cisco Umbrella Rank: 3611 eps.6sc.co — Cisco Umbrella Rank: 11869	22 KB
11	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 td.doubleclick.net — Cisco Umbrella Rank: 192 ad.doubleclick.net — Cisco Umbrella Rank: 150 10104846.fls.doubleclick.net — Cisco Umbrella Rank: 324916 cm.g.doubleclick.net — Cisco Umbrella Rank: 283	9 KB
9	adsrvr.org 8 redirects match.adsrvr.org — Cisco Umbrella Rank: 373 insight.adsrvr.org — Cisco Umbrella Rank: 945	7 KB
8	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	743 KB
7	adnxs.com 5 redirects secure.adnxs.com — Cisco Umbrella Rank: 479 ib.adnxs.com — Cisco Umbrella Rank: 267	7 KB
6	ml314.com 1 redirects ml314.com — Cisco Umbrella Rank: 1614	14 KB
6	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2568 tracking.crazyegg.com — Cisco Umbrella Rank: 4786	41 KB
6	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	127 KB
5	outbrain.com amplify.outbrain.com — Cisco Umbrella Rank: 3182 tr.outbrain.com — Cisco Umbrella Rank: 3133 wave.outbrain.com — Cisco Umbrella Rank: 3153	10 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 243 fortinet.demdex.net — Cisco Umbrella Rank: 337765	3 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	2 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 2579	10 KB
4	mountain.com dx.mountain.com — Cisco Umbrella Rank: 4802 px.mountain.com — Cisco Umbrella Rank: 5019 gs.mountain.com — Cisco Umbrella Rank: 9568	11 KB
4	google.com www.google.com — Cisco Umbrella Rank: 3	192 B
3	tapad.com 3 redirects pixel.tapad.com — Cisco Umbrella Rank: 446	1 KB
3	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1074	2 KB
3	contanuity.com intentstream.contanuity.com — Cisco Umbrella Rank: 54170 tracking.contanuity.com — Cisco Umbrella Rank: 17825	1 KB
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 962	839 B
3	t.co t.co — Cisco Umbrella Rank: 859	2 KB
3	argusplatform.com tmp.argusplatform.com — Cisco Umbrella Rank: 329188 pixels.argusplatform.com — Cisco Umbrella Rank: 327978 webtracker.argusplatform.com — Cisco Umbrella Rank: 334208	4 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 25487 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23670	2 KB
3	google.ca www.google.ca — Cisco Umbrella Rank: 12143	192 B
3	bing.com bat.bing.com — Cisco Umbrella Rank: 348	15 KB
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 462	834 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	4 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	71 KB
2	demandscience.com abm-tracking.demandscience.com — Cisco Umbrella Rank: 51915	3 KB
2	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 6545 api.omappapi.com — Cisco Umbrella Rank: 6555	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 413	2 KB
1	steelhousemedia.com px.steelhousemedia.com — Cisco Umbrella Rank: 13137	320 B
1	siteimproveanalytics.io 6033413.global.siteimproveanalytics.io — Cisco Umbrella Rank: 291663	149 B
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3660	12 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 311	14 KB
1	inzynk.io tags.inzynk.io — Cisco Umbrella Rank: 205998	442 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 960	15 KB
1	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 3455	711 B
1	opmnstr.com a.opmnstr.com — Cisco Umbrella Rank: 32696	17 KB
1	simpli.fi tag.simpli.fi — Cisco Umbrella Rank: 4957 i.simpli.fi Failed	2 KB
1	omtrdc.net fortinet.tt.omtrdc.net — Cisco Umbrella Rank: 316588	840 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1371	503 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	295 B
216	45

	Domain	Requested by
67	www.fortinet.com	www.fortinet.com
23	assets.adobedtm.com	cdn.cookielaw.org assets.adobedtm.com
9	b.6sc.co
8	match.adsrvr.org	7 redirects
8	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com abm-tracking.demandscience.com
6	ml314.com	1 redirects www.fortinet.com ml314.com
6	cdn.cookielaw.org	www.fortinet.com cdn.cookielaw.org
4	ib.adnxs.com	3 redirects
4	tags.srv.stackadapt.com	www.fortinet.com tags.srv.stackadapt.com
4	td.doubleclick.net	www.googletagmanager.com
4	www.google.com	www.googletagmanager.com
4	script.crazyegg.com	www.fortinet.com script.crazyegg.com
4	dpm.demdex.net	1 redirects www.fortinet.com
3	pixel.tapad.com	3 redirects
3	ps.eyeota.net	2 redirects
3	analytics.twitter.com
3	t.co
3	px.ads.linkedin.com	1 redirects snap.licdn.com
3	secure.adnxs.com	2 redirects
3	www.google.ca
3	googleads.g.doubleclick.net	www.googletagmanager.com
3	bat.bing.com	assets.adobedtm.com bat.bing.com
2	px.mountain.com	dx.mountain.com px.mountain.com
2	idsync.rlcdn.com	2 redirects
2	www.facebook.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	10104846.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	intentstream.contanuity.com	abm-tracking.demandscience.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	abm-tracking.demandscience.com	www.fortinet.com abm-tracking.demandscience.com
2	tracking.crazyegg.com	script.crazyegg.com
2	www.google-analytics.com	www.googletagmanager.com
2	eps.6sc.co	j.6sc.co
2	tr.outbrain.com	amplify.outbrain.com
2	amplify.outbrain.com	www.fortinet.com amplify.outbrain.com
1	pixel.rubiconproject.com	1 redirects
1	cm.g.doubleclick.net	1 redirects
1	insight.adsrvr.org	1 redirects
1	px.steelhousemedia.com
1	gs.mountain.com	px.mountain.com
1	webtracker.argusplatform.com	tmp.argusplatform.com
1	tracking.contanuity.com	abm-tracking.demandscience.com
1	6033413.global.siteimproveanalytics.io
1	siteimproveanalytics.com	assets.adobedtm.com
1	cdn.jsdelivr.net	abm-tracking.demandscience.com
1	pixels.argusplatform.com	tmp.argusplatform.com
1	px4.ads.linkedin.com
1	metrics.fortinet.com
1	tags.inzynk.io	assets.adobedtm.com
1	snap.licdn.com	www.fortinet.com
1	static.ads-twitter.com	www.fortinet.com
1	dx.mountain.com	www.fortinet.com
1	pixel.mathtag.com	www.fortinet.com
1	tmp.argusplatform.com	www.fortinet.com
1	trk.techtarget.com	www.fortinet.com
1	api.omappapi.com	a.opmnstr.com
1	a.omappapi.com	a.opmnstr.com
1	ad.doubleclick.net
1	a.opmnstr.com	assets.adobedtm.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	wave.outbrain.com	amplify.outbrain.com
1	tag.simpli.fi	assets.adobedtm.com
1	j.6sc.co	www.fortinet.com
1	fortinet.tt.omtrdc.net	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	www.fortinet.com
1	geolocation.onetrust.com	cdn.cookielaw.org
0	i.simpli.fi Failed	tag.simpli.fi
216	69

This site contains links to these domains. Also see Links.

Domain
forums.ivanti.com
www.horizon3.ai
www.cisa.gov
www.rapid7.com
www.fortiguard.com
www.linkedin.com
www.x.com
www.youtube.com
www.instagram.com
www.facebook.com
fortiguard.com
community.fortinet.com
investor.fortinet.com
onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-16` - `2025-07-15`	a year	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
script.crazyegg.com Cloudflare Inc ECC CA-3	`2024-08-02` - `2024-12-31`	5 months	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-14` - `2024-12-14`	a year	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.google-analytics.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.google.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-27` - `2025-09-25`	a year	crt.sh
a.opmnstr.com R10	`2024-09-21` - `2024-12-20`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.doubleclick.net WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-06-30` - `2025-07-30`	a year	crt.sh
*.google.ca WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
a.omappapi.com R10	`2024-09-21` - `2024-12-20`	3 months	crt.sh
omappapi.com WE1	`2024-10-12` - `2025-01-10`	3 months	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
abm-tracking.demandscience.com R10	`2024-10-13` - `2025-01-11`	3 months	crt.sh
tmp.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh
*.mathtag.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-04-23` - `2025-04-30`	a year	crt.sh
*.mountain.com Go Daddy Secure Certificate Authority - G2	`2024-05-23` - `2025-06-24`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M03	`2024-08-09` - `2025-09-06`	a year	crt.sh
*.inzynk.io Amazon RSA 2048 M02	`2024-01-07` - `2025-02-04`	a year	crt.sh
metrics.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-26` - `2025-01-25`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
t.co E5	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-07` - `2025-10-06`	a year	crt.sh
ibc-flow.techtarget.com WR3	`2024-08-28` - `2024-11-26`	3 months	crt.sh
52.22.50.55 Sectigo RSA Domain Validation Secure Server CA	`2024-01-26` - `2025-02-14`	a year	crt.sh
pixels.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-08` - `2025-03-08`	6 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
intentstream.contanuity.com E5	`2024-10-14` - `2025-01-12`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-07-24` - `2024-10-22`	3 months	crt.sh
siteimproveanalytics.com WE1	`2024-08-19` - `2024-11-17`	3 months	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-08-21` - `2024-11-19`	3 months	crt.sh
*.global.r1.siteimproveanalytics.io Amazon RSA 2048 M02	`2024-09-02` - `2025-10-01`	a year	crt.sh
tracking.contanuity.com R11	`2024-09-11` - `2024-12-10`	3 months	crt.sh
webtracker.argusplatform.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-09-09` - `2025-03-09`	6 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Frame ID: 82BE82CB790AD62079ABB99EFD9AED3E
Requests: 209 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: CCF3B5AA8CA15F4AA66D12B8EEEC8DF6
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/662878185?random=1729001504558&cv=11&fst=1729001504558&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: DBD465ACE4D78FFAF860B89F54D68D45
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=572786102.1729001504;ps=1;pcor=1963096138;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Frame ID: 55CE5E284BA114536DA029CF0B9068F6
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/729495989?random=1729001504701&cv=11&fst=1729001504701&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 3E3F6203BAAFCBD9225EA493BB2BE51A
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/609297413?random=1729001504766&cv=11&fst=1729001504766&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: C53000E8B76CB1133AA249EE51F72E96
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=CNe7u8TIkIkDFfWbjggdWVUx_g;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=7278221554572.3545
Frame ID: 5A44D01659CF5FA0FBAA9833D6A96516
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA | FortiGuard Labs

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

FingerprintJS (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/fingerprintjs@(\d)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

216
Requests

93 %
HTTPS

29 %
IPv6

45
Domains

69
Subdomains

59
IPs

2
Countries

6430 kB
Transfer

10297 kB
Size

85
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190?language=de
Title: CVE-2024-8190

Search URL Search Domain Scan URL

URL: https://www.horizon3.ai/attack-research/cisa-kev-cve-2024-8190-ivanti-csa-command-injection/
Title: the details

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
Title: here

Search URL Search Domain Scan URL

URL: https://www.rapid7.com/blog/post/2024/01/11/etr-zero-day-exploitation-of-ivanti-connect-secure-and-policy-secure-gateways/
Title: here

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/threat-signal-report/5556
Title: https://www.fortiguard.com/threat-signal-report/5556

Search URL Search Domain Scan URL

URL: https://www.fortiguard.com/encyclopedia/ips/56651
Title: https://www.fortiguard.com/encyclopedia/ips/56651

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.x.com/Fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fortinet/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://community.fortinet.com/
Title: Fortinet Community

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 78

https://cm.everesttech.net/cm/dd?d_uuid=61365736992321897700592417269413966323 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zw54HwAAAMUIxwN_

Request Chain 162

https://secure.adnxs.com/px?id=1773420&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Request Chain 163

https://ib.adnxs.com/seg?add=36113683 HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Request Chain 169

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001505388&li_adsId=d00ac2ec-0178-4a13-abed-3d7a242e6152&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001505388&li_adsId=d00ac2ec-0178-4a13-abed-3d7a242e6152&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&e_ipv6=AQL7CDM3cHdGaQAAAZKQhUL__M84N-g19CrhH92YLcrEcHcJ44-1O2xRtu0U3Afs94Lvgb6m

Request Chain 181

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=7278221554572.3545 HTTP 302
https://10104846.fls.doubleclick.net/activityi;dc_pre=CNe7u8TIkIkDFfWbjggdWVUx_g;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=7278221554572.3545

Request Chain 201

https://idsync.rlcdn.com/395886.gif?partner_uid=3647725148076245074 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzY0NzcyNTE0ODA3NjI0NTA3NBAAGg0IovC5uAYSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=408c93b6987dc70f430f230c1d7d3dda9b18f0782b3137b8f9b45a758594f1e3f4cb09cee1a4f8eb&person_id=3647725148076245074&eid=50082

Request Chain 202

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&gdpr=0&gdpr_consent=

Request Chain 203

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3647725148076245074%26eid=2 HTTP 302
https://ml314.com/csync.ashx?fp=1300617778988373177&person_id=3647725148076245074&eid=2

Request Chain 204

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=29pNpqh8U7IYTxJ6VUsI6pcUmzAgkddVkVDThh4SFILQ&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

Request Chain 206

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=58d0314c08f435da2e1fccee497d419a_1729001505816 HTTP 303
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=58d0314c08f435da2e1fccee497d419a_1729001505816&_bee_ppp=1 HTTP 303
https://tracking.contanuity.com/usersync?bwcookie=AADCok7OHPAAABVbbK9ifg

Request Chain 213

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=6a64d09a-8aff-11ef-b7dc-a197cc410e3f&gdpr=&gdpr_consent= HTTP 302
https://px.steelhousemedia.com/tdsync?tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&shguid=6a64d09a-8aff-11ef-b7dc-a197cc410e3f

Request Chain 214

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YzViOTM1ZjYtYjBhOS00MzRkLWJiM2ItYzA2YWRlMWVkNWI1&gdpr=0&gdpr_consent=&ttd_tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5 HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&google_gid=CAESEEk2CL4Ncft1FytSd1WxnSI&google_cver=1 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5 HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=1300617778988373177&ttd_tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5 HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1830&partner_device_id=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad HTTP 302
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D08936234-aa45-46e6-8571-aeb5ac0ba97b%252Chttps%25253A%25252F%25252Fmatch.adsrvr.org%25252Ftrack%25252Fcmf%25252Fgeneric%25253Fttd_pid%25253Dtapad%252C HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=1300617778988373177&pt=08936234-aa45-46e6-8571-aeb5ac0ba97b%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%252Fgeneric%253Fttd_pid%253Dtapad%2C HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad

216 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa Show response
www.fortinet.com/blog/threat-research/ 133 KB
31 KB 356ms
46ms Document
text/html 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

e43a78cb528d99356d4426d8975072a19dbbbd71273d0d746f1287a2696d6853

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Age: 4213
Cache-Control: max-age=600, public, s-maxage=10800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 30578
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Type: text/html;charset=utf-8
Date: Tue, 15 Oct 2024 13:02:47 GMT
ETag: "21455-624838d47e4b4-gzip"
Last-Modified: Tue, 15 Oct 2024 13:01:29 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qEUSRkSYCBjPO6h9zwLp9RMOXXa7vlqy4OgB0agiGuH32au2IfD0Ag==
X-Amz-Cf-Pop: IAD61-P4
X-Cache: Hit from cloudfront
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1-28559771
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK visitorapi.min.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 64 KB
30 KB 129ms
51ms Script
application/javascript 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "fe2d-6117284c96900-gzip"
Age: 1011650
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: -pIZO8i4aNPASpefizEX0MLsYWIQrhm29Uyf0WFasnJWFwv2par-Aw==
Date: Tue, 15 Oct 2024 14:10:47 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 15 Feb 2024 21:43:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29532
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK at.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 104 KB
48 KB 139ms
64ms Script
application/javascript 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "19e83-61431fc4b24c0-gzip"
Age: 310468
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: vmHVauc_iO645hiQSlfzDyPPOmewqOBRqagyTjhIBB5LIHlg61wxtA==
Date: Fri, 11 Oct 2024 23:57:14 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 21 Mar 2024 20:59:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47782
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.900b148ab7b87024003111a1245cca9c.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 540 KB
28 KB 66ms
51ms Stylesheet
text/css 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "86e1b-61b58883c7740-gzip"
Age: 1011487
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: b4_VAY055tP3r4n4-K_TlDp_76piZAS9Ax4zEf4LsApnn-XzIKZ_ww==
Date: Tue, 15 Oct 2024 14:01:47 GMT
Content-Type: text/css;charset=utf-8
Last-Modified: Thu, 20 Jun 2024 20:55:17 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 27478
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 82ms
29ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: jwlUUXc1HMPClYXMpY+NPQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCECBD439DB9BF
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 2151
x-content-type-options: nosniff
date: Tue, 15 Oct 2024 14:11:42 GMT
content-type: application/javascript
last-modified: Tue, 15 Oct 2024 02:01:20 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 8f7ade6b-901e-0064-2ea7-1e232a000000
cf-ray: 8d30665d0ec1a314-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6881
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 121ms
47ms Image
image/svg+xml 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 517153
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: vhKZquubbrJNLYww0hqk6tLKcjG7o0Qk84y1EnOToBxPdXAw5xaysQ==
Date: Wed, 09 Oct 2024 14:32:29 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
3 KB 114ms
40ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4fd-60a2031eb4f40"
Age: 29018238
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 7qJTSgDgPG8hPqqiRgBaxc-9XuHqpEFBF_UbpmAIw2CBp3oNcaum0w==
Date: Tue, 15 Oct 2024 14:01:47 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 160 KB
74 KB 50ms
48ms Script
application/javascript 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "28100-61cff12ce1d80-gzip"
Age: 1011641
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: g9hFmJKPStw80G5SpOMT4d4wfrpy3mHuXJ0G_41MNetO0s8EF7MU8Q==
Date: Tue, 15 Oct 2024 14:10:40 GMT
Content-Type: application/javascript;charset=utf-8
Vary: Accept-Encoding
Last-Modified: Thu, 11 Jul 2024 21:01:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 74768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 5 KB
2 KB 81ms
41ms XHR
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Uj3iBUKm1Vl2g2NHq67V+w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF23DF5130
age: 62683
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Wed, 16 Oct 2024 14:11:42 GMT
date: Tue, 15 Oct 2024 14:11:42 GMT
content-type: application/json
last-modified: Thu, 28 Dec 2023 19:56:54 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: c21183be-301e-00a5-5054-cda893000000
cf-ray: 8d30665dafe9a297-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1792
x-ms-blob-type: BlockBlob
server: cloudflare

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK ivanti-hero.jpg
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 220 KB
222 KB 47ms
47ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/ivanti-hero.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

18041a7dd2be9d4ba5469edca86d5bd763e3bdcae7a83c5559c618bf4be83f0f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3715e-6242cd5d60d40"
Age: 333279
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: v3dHvnkov5zMKNnjePSwvYwwvFBxSwkDzPOPDM9zeN6UifDLql32TQ==
Date: Fri, 11 Oct 2024 17:45:35 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:34:05 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 225630
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK siemens-vuln-discovery-center-thumb.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 146 KB
147 KB 44ms
43ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/siemens-vuln-discovery-center-thumb.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b3f4fd3661f04c2c6374215073e85cb8c5c938ee783677f40e85151989c39d97

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "24631-5e417b82eaa40"
Age: 36202769
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: gF70uiUiKDhQPHfqRR03eb_K2HxnL0NUMLS9rmcZH9nSm9xsoShPbg==
Date: Tue, 15 Oct 2024 14:08:00 GMT
Content-Type: image/png
Last-Modified: Mon, 18 Jul 2022 17:30:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 149041
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ransomware-roundup-thumb.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 142 KB
144 KB 49ms
48ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/ransomware-roundup-thumb.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

727d19bf895438013bb188825e546dd6e61f80c2a4ea8e7b6e978b96bab546f4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "23995-5e41c8188d9c0"
Age: 36204708
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: NE0pDwytFTowAv3iTjuKQS9zZvnXwYMssqa9Jp7uhMWoBrBnQtY8ww==
Date: Tue, 15 Oct 2024 14:08:00 GMT
Content-Type: image/png
Last-Modified: Mon, 18 Jul 2022 23:12:47 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 145813
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK MOVEIT-THUMB.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 124 KB
126 KB 41ms
40ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/MOVEIT-THUMB.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

443f47f0ae01cec5b4bc117dffb451485e147a54865efa7c820320e68cb55909

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1f0d8-5fd8fff10e040"
Age: 36204757
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: qgJj4mWyR7tBWhYx1aeT6wzNb4OkfvT0HbAmAaaoP35KLqgSxUef-w==
Date: Tue, 15 Oct 2024 14:08:00 GMT
Content-Type: image/png
Last-Modified: Wed, 07 Jun 2023 20:29:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 127192
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
38 KB 45ms
44ms Font
application/octet-stream 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.900b148ab7b87024003111a1245cca9c.css

Response headers

X-Vhost: publish
ETag: "9354-5df4fa74ff980"
Age: 1005628
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: JoRel9HJ71pWBPx9lp8rtbZ_tCsVLKAPT2ZQVo8Fhq-JfrclwOZx7w==
Date: Fri, 04 Oct 2024 00:03:55 GMT
Content-Type: application/octet-stream
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37716
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
295 B 111ms
49ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db0da7efe3ac5fc9e598f71e291326f137ea7bbbf97fed4fee0e86b717b0d9a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8d30665f1a50a26f-YUL
access-control-allow-origin: *
date: Tue, 15 Oct 2024 14:11:42 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK ivanti-web-request-client-index.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1728620161388/ 46 KB
47 KB 47ms
44ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image.img.jpeg/1728620161388/ivanti-web-request-client-index.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

26b37b2982358112ad578340484a7de6274a19db3fb6ea13f0b4e2d89e35f566

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "b76f-6242bbea5e240"
Age: 40878
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: oPA1fxYOeP52ldfOFcsNmScg0oS8IOI-iIo8Nz91rql7x_S6gAi5Zw==
Date: Tue, 15 Oct 2024 13:02:48 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 46959
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig01-ivanti-gui-dl-landesk.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1172236801.img.jpeg/1728620210875/ 93 KB
94 KB 46ms
42ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1172236801.img.jpeg/1728620210875/fig01-ivanti-gui-dl-landesk.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

1d3e1ffd86a5653412775034689e08d77352a1a255038f3cf953b76318ac946a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1733a-6242bc1919080"
Age: 40878
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: EcutUFNGuwYX6RMNSUk8IuUz8ayHxbEbsNvS6Wimau4kFQHwZ2_7sQ==
Date: Tue, 15 Oct 2024 13:02:48 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:16:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 95034
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig02-ivanti-redirection-download.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2006588417.img.jpeg/1728620263874/ 15 KB
16 KB 47ms
43ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2006588417.img.jpeg/1728620263874/fig02-ivanti-redirection-download.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

933ddaeb7b389ab0803e3e7a1124cd51dcd097514e5e1cff4d4cef50b219779e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3bfd-6242bc4ba47c0"
Age: 40878
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: q_n25bwiE1ArD5hYu67JLOu8xOn6wdC3k03ZzFc138_V5HWHc1pJXw==
Date: Tue, 15 Oct 2024 13:02:48 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:17:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 15357
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig03-ivanti-redirection-ondemand.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_184115790.img.jpeg/1728620317634/ 8 KB
9 KB 48ms
43ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_184115790.img.jpeg/1728620317634/fig03-ivanti-redirection-ondemand.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

17095b0dfaded492b73f4f6a30412ecb2f7a87a2ebd1f8963d5c5cee3db937bd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2011-6242bc7f24140"
Age: 40878
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: blLkQsVUEYKT8jdhhH-cGW1XRI6kMKOMey5tiUsBYWarl01TqYIZGQ==
Date: Tue, 15 Oct 2024 13:02:48 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:18:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 8209
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig04-ivanti-code-vulnerable.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_853574561.img.jpeg/1728620365076/ 44 KB
46 KB 49ms
42ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_853574561.img.jpeg/1728620365076/fig04-ivanti-code-vulnerable.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

80979b936a389e029f1d96f9b57e39257416add377d59a14c91708c48cc60ae2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "b104-6242bcacead40"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Cco5vAnWWL2_5orGetrLcQplfGAwSsgX07BEYWB1SmWhAfGhRchujg==
Date: Tue, 15 Oct 2024 13:02:48 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:19:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 45316
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-client-index-gsb-users.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_870303825.img.jpeg/1728620426185/ 17 KB
18 KB 118ms
111ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_870303825.img.jpeg/1728620426185/ivanti-client-index-gsb-users.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f53109bc9c1f5eba5a8e47a82b8a8e12de6fdd2c81f0a5320d5cd457708a5324

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "43b0-6242bce717680"
Age: 40661
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: wzg8chy6sxt9JfvmJsYol9gziyDzO3r52j69_kTAC8x-tLiuqsa7yw==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:20:26 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 17328
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig05-ivanti-path-traversal.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1543583598.img.jpeg/1728620510929/ 59 KB
60 KB 70ms
69ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1543583598.img.jpeg/1728620510929/fig05-ivanti-path-traversal.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

cbe67b5b6fa27d2f9d4f18dba4f940ce8c4a3dbcab1541b5b1023ce4dcea66e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "ebd4-6242bd3733380"
Age: 40877
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: _oDvxvVoKUlRF_T4SDLr9YW7kCZClMlWdhuOhJ7zKnZxU-Vtvet4zA==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:21:50 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 60372
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig06-ivanti-path-traversal-vulnerability.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1413617697.img.jpeg/1728620553579/ 126 KB
127 KB 43ms
40ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1413617697.img.jpeg/1728620553579/fig06-ivanti-path-traversal-vulnerability.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a364f8998ea88f243a482109d256626e8d7cb72a05eac69ac608c27435241a65

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1f626-6242bd6035440"
Age: 40833
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 18EXcm7xwm01AhsgYrJT4oj4xx7Jo35Uip4qZguLeKyk-EZ_jmHM4w==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:22:33 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 128550
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-csa-management-console.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2028077941.img.jpeg/1728620592057/ 31 KB
32 KB 39ms
39ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2028077941.img.jpeg/1728620592057/ivanti-csa-management-console.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d4edec0e6d150110e180ad38f47e5eab79358d5df97f12e15c73a4b538863451

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ada-6242bd8566c00"
Age: 40877
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ppMopIxGaP_LOAm0udSO34OqHMKDTiJe1As4_NfOZ5tbZmMePPXDVg==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:23:12 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31450
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig07-ivanti-sqli-vulnerabilty-exploitation.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_288801384.img.jpeg/1728620655617/ 173 KB
174 KB 40ms
39ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_288801384.img.jpeg/1728620655617/fig07-ivanti-sqli-vulnerabilty-exploitation.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

ad15ab06d640d365a00d41e146660addb01348b2f6878f6ffdc1dc428c67cc19

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2b2af-6242bdc17b9c0"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: p1nVBBqGnqyivR0GGzjftvnJtwEaoeXttw6Eu4Dp8LF7VIgxoVa-5Q==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:24:15 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 176815
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig08-ivanti-setting-timezone-value.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_512758081.img.jpeg/1728620707132/ 25 KB
26 KB 41ms
40ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_512758081.img.jpeg/1728620707132/fig08-ivanti-setting-timezone-value.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0e6e31465592638aaa036384d85ebd6e6c56b9178591bceea4a0b815dd06d535

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "6205-6242bdf312ec0"
Age: 40830
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 766TgMhf4PaNuUtgf38t5i9p7gviRKykXWfL-h85UKCGWcG7XM-O-Q==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:25:07 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 25093
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig09-ivanti-vulnerabie-function.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_156964748.img.jpeg/1728620764864/ 29 KB
31 KB 43ms
42ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_156964748.img.jpeg/1728620764864/fig09-ivanti-vulnerabie-function.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

7c37b5d2c568700acb5aa4d6fc9ece9bc0df8882dc473d944a854ade711a696c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "758d-6242be296ef00"
Age: 40830
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zlSRlaeOeoBeUFE3ivxkCv5nrnTvn_E2sKJ7OQ5YeznpDkY1gWrNFA==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:26:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 30093
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig10-ivanti-time-zone-change.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_546641334.img.jpeg/1728620805020/ 58 KB
59 KB 42ms
42ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_546641334.img.jpeg/1728620805020/fig10-ivanti-time-zone-change.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

ec5a240780ab83205367dfb9274a408269d2a10d837164fe39eebabd757d9e7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "e618-6242be5088b40"
Age: 40833
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: xxMArUSv_BEX1Wo9T4yTnYvy8dheg_P9OpO0hDVeOetatU0Wse-_Lg==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:26:45 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 58904
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig11-ivanti-post-variable-timezone.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_879745814.img.jpeg/1728620849864/ 87 KB
89 KB 38ms
37ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_879745814.img.jpeg/1728620849864/fig11-ivanti-post-variable-timezone.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f21e3a5a80821feb91e7bb84d525742fd137c4b336f3ff3f1bb15dc2fcae9d70

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "15d27-6242be7a7ee40"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: y0KKusAiRlcyFfSRLmQZ1IZ6hSBK7GffDJkHjZ1gj2c9BLYt41fcOw==
Date: Tue, 15 Oct 2024 13:02:49 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:27:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 89383
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig12-ivanti-decoded-base64.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1686730515.img.jpeg/1728620888293/ 112 KB
114 KB 39ms
38ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1686730515.img.jpeg/1728620888293/fig12-ivanti-decoded-base64.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8af6fb23ba1c0a4860476b240ba2d05c02ff018f1a93d2caadf7301ed87223d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1c1e7-6242be9fb0600"
Age: 40830
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: pZkKYhJnYJVAokTua_yTT0milFEv7goPEVhEpkVGCHVAknUCTCk1mw==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:28:08 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 115175
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig13-ivanti-broker-conf.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_658029349.img.jpeg/1728620938935/ 31 KB
32 KB 40ms
39ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_658029349.img.jpeg/1728620938935/fig13-ivanti-broker-conf.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0968bbb30f1aef951bb770793756fca4fd75cce26bce318ace9c6e31deddf7f6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ab8-6242becf5f680"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: TdraY4kcXMiAw7GiCPMXPH_DiTQ-5DqvajX5_FPM_eIWPdrE-iKjBg==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:28:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31416
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig14-ivanti-root-user-private-key.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_669364972.img.jpeg/1728620991417/ 11 KB
13 KB 39ms
39ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_669364972.img.jpeg/1728620991417/fig14-ivanti-root-user-private-key.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bd6f701d7b3abd41679f87c496bc8911a602f247900dfc7ab7cb3a62abe098ee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2cda-6242bf01eadc0"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Y_EEnraxUlULDoF0lHM4Br7UK0560t_R3hm2kQ15U0T3uBXjTAy_zg==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:29:51 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 11482
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig15-ivanti-postgres-database.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_801722592.img.jpeg/1728621025851/ 96 KB
98 KB 39ms
38ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_801722592.img.jpeg/1728621025851/fig15-ivanti-postgres-database.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b69b5763c6c912b8a1852981c4401647963d63734e234b073d97c0dffbf64206

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "180ac-6242bf2257a40"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: GlUPFkQSJInsTOPu4J3JxvSVnhHa5xooD_o0sG32VQku4zQUNWp_4A==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:30:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 98476
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig16-ivanti-command-injection.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841058103.img.jpeg/1728621069609/ 111 KB
112 KB 39ms
38ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841058103.img.jpeg/1728621069609/fig16-ivanti-command-injection.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

cff43ffcd3d9feaba4fb1250d800a3b9650a7f65c26f00b196e403cc763ee1d4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1bbea-6242bf4c4dd40"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: IFs7ZekVl8ExCNq5T_qhG28HkhceKeNcsX3tctMyuz-2tlaC2rKy8Q==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:31:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 113642
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-malicious-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1382954794.img.jpeg/1728621104113/ 16 KB
17 KB 39ms
38ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1382954794.img.jpeg/1728621104113/ivanti-malicious-command.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d3cdd8255b0cabf4568ec33c19f12ef6a3a761ea27bb36f0e1a12d9c4f31a2f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3ec2-6242bf6daec00"
Age: 40876
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: eDsaOSp4EJbl1kJb13s1G0AQWHmHB4U6wlSZZJS_aO-0favUUA5J-g==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:31:44 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 16066
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig17-ivanti-command-injected.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_611292844.img.jpeg/1728621139581/ 18 KB
19 KB 41ms
41ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_611292844.img.jpeg/1728621139581/fig17-ivanti-command-injected.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f797f871bec64d4d54308abab8c7008df6b855a83b59dbc17665e3c4111e7032

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4858-6242bf8f0fac0"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: EswpkQN7Yp8cyn1y2Fdg88Lxmoy-6bYWPRh3kyDVuSAlPleoYoWu2Q==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:32:19 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 18520
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig18-ivanti-code-vulnerable.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_115137765.img.jpeg/1728621184124/ 70 KB
71 KB 94ms
93ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_115137765.img.jpeg/1728621184124/fig18-ivanti-code-vulnerable.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

c584b5d0f98a654a3857877fa1e3dbb85b0b0e779191ad952af4e14116205e2c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "11771-6242bfb9fa000"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: BKQcv-s68HFs76MbqBa_-3y_LiwYCPu34KEKyahPBe6vD28KlUSeUg==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:33:04 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 71537
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig19-ivanti-update-function.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2034876463.img.jpeg/1728621223395/ 55 KB
56 KB 86ms
83ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2034876463.img.jpeg/1728621223395/fig19-ivanti-update-function.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

5cde97a99252b4ad4fa0d3becd808a64e2b1946feef502515a47aab3f9110f7c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "da41-6242bfdf2b7c0"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: dlM_XsRHRvAylQN0E-e_txo1Gvw-M3pQiNCirpidPlhTuiKPipF77A==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:33:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 55873
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig20-ivanti-files-patch.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_450058568.img.jpeg/1728621256835/ 87 KB
88 KB 73ms
71ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_450058568.img.jpeg/1728621256835/fig20-ivanti-files-patch.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a9a345b743fb7460be8d7e10ca085ea57901980b67d43151196d36f94a5451cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "15a79-6242bffea4200"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 5PdufvrH7kBtHerlsBLXWOxPfnkz7Xmtt9BkeC3kLEEi_xl6UVhO_A==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:34:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 88697
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig21-ivanti-patch-script.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1942091345.img.jpeg/1728621289333/ 101 KB
103 KB 71ms
71ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1942091345.img.jpeg/1728621289333/fig21-ivanti-patch-script.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

36186e198e296c76785020a85f35312fbf538fe48f96b8358b01c25cb5b673e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1958b-6242c01e1cc40"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Y-1UQLKr8icV9JWAyv_elv-TkasPhhBdtMlPNY8I9XcFk3xy09u8iA==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:34:49 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 103819
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-temp-tmp-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_479439523.img.jpeg/1728621332478/ 29 KB
30 KB 59ms
44ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_479439523.img.jpeg/1728621332478/ivanti-temp-tmp-command.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

18f5794db26670e34d8df06806be8536dc6520a380dcf67bced51fc8f7ef91e1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "73b9-6242c0471ed00"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: UM6H-nizaynG-DbHKS-dGAh5keZ5ZZ1Z99QQSUGOxIm_CpBkQ4ilRQ==
Date: Tue, 15 Oct 2024 13:02:50 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:35:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29625
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig22-ivanti-patch-timestamp.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_280612408.img.jpeg/1728621400402/ 22 KB
24 KB 54ms
54ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_280612408.img.jpeg/1728621400402/fig22-ivanti-patch-timestamp.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

4aa70a752741f88840c0ae6612f71b6220ac77080c263caa1682cee47d9b39da

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "59be-6242c087f8600"
Age: 40875
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: XtWBHsyGEiq2P7BmmEQ7QcS9VInf5or40Cd0MfiWmmGhmpofpQyZRw==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:36:40 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 22974
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig23-ivanti-patch-timestamp-datetimetab.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1121393809.img.jpeg/1728621473905/ 15 KB
16 KB 46ms
45ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1121393809.img.jpeg/1728621473905/fig23-ivanti-patch-timestamp-datetimetab.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

643a52fac3e3aae163ef76ad0a2a088d2f31ac2552eff000edc1b495c8fbba32

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "3c34-6242c0cd96a40"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: dZCpOJK-ryJiZE5auRYAxRNlR0cBF297wB_bFbxKa4GFBQ6_pST5-g==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:37:53 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 15412
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig24-ivanti-comparison-code.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1656384028.img.jpeg/1728621510804/ 93 KB
94 KB 71ms
71ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1656384028.img.jpeg/1728621510804/fig24-ivanti-comparison-code.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8ef9e9b7103e38d4509a125612dad3ff98edfd671fa45f01d4d09c3cefa50a8f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1737c-6242c0f0dfd80"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: qoF_-MaEGnJt3c4nfDpO2EkabHihmobI3ROTBTO8M_nZ28x9ewTJDA==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:38:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 95100
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig25-ivanti-exploitation-testing.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1136962043.img.jpeg/1728621561290/ 129 KB
130 KB 57ms
57ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1136962043.img.jpeg/1728621561290/fig25-ivanti-exploitation-testing.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bb13a80fdd4875e6626de9e2b4ebf7948f3cfe191f73b4dbf31e1247d0239667

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "20339-6242c12183040"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: rCnKpTaUWw_evoEcPgcr3jMjza8ll0jp9WwyxI8TJPKbtS6dPRC0Vg==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:39:21 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 131897
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig26-ivanti-testing-command-injection.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1958099435.img.jpeg/1728621691327/ 107 KB
108 KB 59ms
39ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1958099435.img.jpeg/1728621691327/fig26-ivanti-testing-command-injection.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

bec3437c8baa45a6344648c2bb6806831972c5cdd7ae34a16897d6e205092476

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1ab81-6242c19d7d4c0"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: DtC7_hOnlcOHj0FQfxKQEkJcS_-606R5a56BWXzZPR0nglx919Psww==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:41:31 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 109441
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-sample-malicious-post.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2136686996.img.jpeg/1728621736636/ 65 KB
66 KB 49ms
38ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_2136686996.img.jpeg/1728621736636/ivanti-sample-malicious-post.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

1a8491dacfaed6de53e20ff200c81255fb61def72f2696426a23ec5a05265b28

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10408-6242c1c867a00"
Age: 40874
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Ve4bNRqOkIswPTRRTn3lp_OWESERrx4Wd6MuFeKATvCMkj9Z3nsYNw==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:42:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 66568
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-sqls-remote-code-execution.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_958399012.img.jpeg/1728621780661/ 89 KB
90 KB 40ms
38ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_958399012.img.jpeg/1728621780661/ivanti-sqls-remote-code-execution.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d5dc4157271c9d3147055b0f2b85578271417af24cb1cfd197b84194ddaa0bfa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "16350-6242c1f25dd00"
Age: 40873
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: hjdlv4GQFiiBBWQaKlbZ7PnmPP043rPy-rU37R-rwRZeUrZBe-Lp1A==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:43:00 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 90960
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table01-ivanti-threat-actor-commands.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_133352251.img.jpeg/1728621923615/ 50 KB
51 KB 41ms
40ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_133352251.img.jpeg/1728621923615/table01-ivanti-threat-actor-commands.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

717f11c79608856a33546a50fe20ac984c44c933ba23ea02c851f8f0004df1fd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "c75d-6242c27abdec0"
Age: 40873
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: BMJr9i-x9D7aI8f3Jra3gh9eJZUOaBZASBokMlTD6EXMIeswrksaNA==
Date: Tue, 15 Oct 2024 13:02:51 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:45:23 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 51037
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-powershell-command.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1877150742.img.jpeg/1728621963572/ 77 KB
79 KB 45ms
44ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1877150742.img.jpeg/1728621963572/ivanti-powershell-command.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b0b526b901a7afeac92efcd87a441305a26891bba8bfbb950f4b18f7fd582e59

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "134e8-6242c2a0e38c0"
Age: 40873
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ASwNVBBPZwOa6NvPWI4mKYBuquIrHdQXNnx8XA7EHzYkO0xCDCJZlA==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:46:03 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 79080
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig27-ivanti-content-1log.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1065565645.img.jpeg/1728622001838/ 51 KB
53 KB 43ms
42ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1065565645.img.jpeg/1728622001838/fig27-ivanti-content-1log.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

5fa043f0c7d87051071a76bfcd9a59a537991943ba96fde8cc718c5a0919b45b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "ccf0-6242c2c520e40"
Age: 40873
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: jMdq9jGqJBowZ4Vk_dgicJxBMipFm9AimJ88WJKG34DbIXYYwKWVmA==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:46:41 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 52464
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table02a-ivanti-threat-actor-commands.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_554353955.img.jpeg/1728661138131/ 1003 KB
1004 KB 39ms
38ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_554353955.img.jpeg/1728661138131/table02a-ivanti-threat-actor-commands.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

4af5dacf19bc195010075d202d98f083a444a8572cbc1711fe39225928cb6be1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "faaf9-6243549114880"
Age: 40872
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: cwVDtDfQ8io11zfiVtsFHS7bCJei0zbxAti1s-pnHjs3Mh8s7BfS6A==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 15:38:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1026809
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table03-ivanti-web-shells.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1145145370.img.jpeg/1728622608310/ 80 KB
82 KB 40ms
39ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1145145370.img.jpeg/1728622608310/table03-ivanti-web-shells.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

92cfae0b0d343d93e5e1d365bb9179904e50407d803588ec009e2bb19e211ea3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "1416e-6242c50802400"
Age: 40873
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: GPbcam2orxY0_W6ROUIhkFwtIXpdlDN1-OzD4yUp1LeZoDsDtI3Lmw==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:56:48 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 82286
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig28-ivanti-brute-force-tooling.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1202021139.img.jpeg/1728622643931/ 37 KB
38 KB 48ms
48ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1202021139.img.jpeg/1728622643931/fig28-ivanti-brute-force-tooling.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

2e50f9ae9324af2e1d1803215dfa3b1e4476f62bf1c3d548743835992ca87182

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "9326-6242c529632c0"
Age: 40872
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 1-iTsqlwgtMXn1HsZceW51PF_g7tnIZdR5GE0xUNKz-An13oG2_Hgg==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:57:23 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37670
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig29-ivanti-content.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841266866.img.jpeg/1728622674435/ 23 KB
24 KB 42ms
42ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1841266866.img.jpeg/1728622674435/fig29-ivanti-content.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

66a9e8a80c33a2f932441adf709f92aecca67782c8c0c5b1e165584d7eb3a291

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "5c88-6242c546f3880"
Age: 40872
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: xeawGH7aVxc_BtZdElBXYUPg9da2zH2Sx5Yhyx9TwoDgv2iGvWq4wQ==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:57:54 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 23688
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-csa-appliance.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_16445584.img.jpeg/1728622709083/ 41 KB
42 KB 41ms
41ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_16445584.img.jpeg/1728622709083/ivanti-csa-appliance.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

188c1c4378ca30c9eef2b446a37c4a7eb75d043f56acf32c35eb0077bb8705a6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "a328-6242c56854740"
Age: 40872
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: GuY40TtvORIzWSYZrmWWgOneZ_saHNnVZrV5tSTRvAOZ1NqZxlxfTw==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:58:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 41768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-php-variables.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_421608083.img.jpeg/1728622739558/ 35 KB
37 KB 40ms
40ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_421608083.img.jpeg/1728622739558/ivanti-php-variables.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f02faad1987312daa96dcd532794b6db4faa8a623306821b9d26235dbea36983

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "8df4-6242c584f0ac0"
Age: 40872
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: bK4btaBihxhMnbGd1pUkPujwPaqwbPc7s4ATwOWru5W8MEcaBoOq-w==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:58:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 36340
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-linux-kernel.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_38071269.img.jpeg/1728622775542/ 65 KB
66 KB 55ms
53ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_38071269.img.jpeg/1728622775542/ivanti-linux-kernel.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

644e98e4c6ce7519f77dc6c7401426d231c8f895f550c7f6c514bb4ec302ec6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10317-6242c5a745bc0"
Age: 40872
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: qctsL1BCN6RFKWPzaP6TczTbq7lrBUoujZK1HS_iFdkJ1mQ_cPmEvA==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 04:59:35 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 66327
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig30a-ivanti-base64.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1621469609.img.jpeg/1728622837198/ 171 KB
172 KB 43ms
40ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1621469609.img.jpeg/1728622837198/fig30a-ivanti-base64.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

39a543197cee3bd0cac857a39467717e59781b5a8eec38ba40ebcc281e2c78b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "2ac3e-6242c5e266740"
Age: 40872
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ZCzbn4cAXDuLC26-GQ_P4i3v1CDCuntdWaldccx397fbM1nmHVbR_g==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:00:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 175166
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig30b-malicious-tar-file-content.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1244035500.img.jpeg/1728622869372/ 14 KB
16 KB 39ms
38ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1244035500.img.jpeg/1728622869372/fig30b-malicious-tar-file-content.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

61af4356b1a56a808fbe79a6cd0f96444069b54d9eb1a1576b45c0e0f6bae0c5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "38ce-6242c600eaf40"
Age: 40872
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: c8bxk4X3cy_SRj3IE_lHw0TRZ0IceVQYmjr3Yg_sg9YDf3-0tpwljg==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:01:09 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 14542
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig31-ivanti-rootkit-files.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_460351710.img.jpeg/1728622903847/ 20 KB
21 KB 49ms
38ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_460351710.img.jpeg/1728622903847/fig31-ivanti-rootkit-files.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

17234dc33fee83a6097588da7dc802864fd9af021ff0b48fa73a404e30aa362c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "4f8f-6242c62157bc0"
Age: 40871
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: I-SZGUq36c0_Loa9LyTn56mv-dXG2UmeSLCVmymKmq-7W6ZPFw8YJw==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:01:43 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 20367
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-script-start-param.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1397322820.img.jpeg/1728622948264/ 79 KB
80 KB 44ms
38ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1397322820.img.jpeg/1728622948264/ivanti-script-start-param.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

72a16e82ebbe48c45ef6e2a67f4645444081d0cb72e09324824fc123fc30f6a0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "13afb-6242c64c42100"
Age: 40871
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: i0hsh9M7eCf895j4jDfAyw2G3AAlw6ODkD0qSsfezS1A-Hv_TaDtxQ==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:02:28 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 80635
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-script-second-param.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_281043642.img.jpeg/1728622982349/ 12 KB
14 KB 43ms
41ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_281043642.img.jpeg/1728622982349/ivanti-script-second-param.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

f26ae51e214125767e456bc97f886b908749c984035ab7d7432fb11031a2a8e3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "31e8-6242c66caed80"
Age: 40871
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ofIIYC_Zi3mF3nPypF-y2y3PIsAiXC8xgZmwYj89im4tQOBbPNSAVA==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:03:02 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 12776
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK ivanti-code-snippet-path-exists.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1062228048.img.jpeg/1728623065236/ 31 KB
32 KB 40ms
39ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_1062228048.img.jpeg/1728623065236/ivanti-code-snippet-path-exists.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

872f233ef34c09bfa33644108af6f2dfce8f77a0e2dc0847882840355efc4820

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "7ad4-6242c6bbd6840"
Age: 40871
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 5-UAMw2n9Qi4juhn-KzmTrUo8y4GJYod-RuO9A48Vz9v9dGr7GDPzg==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:04:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 31444
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig32-ivanti-installation-malicious-kernel.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_651532223.img.jpeg/1728623117727/ 23 KB
24 KB 58ms
57ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_651532223.img.jpeg/1728623117727/fig32-ivanti-installation-malicious-kernel.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a462bb85392ef235bc0ab080e8a9ae078a228fb74b3df156cb9f3ce7e20ad9e6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "5bd6-6242c6ed6dd40"
Age: 40871
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zrm2_fa0ksxWacAUhYTkMZvTzwWXBheAd_UjU0Pyc8CXy2nA5_QrRA==
Date: Tue, 15 Oct 2024 13:02:53 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:05:17 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 f2f0cb8191da3bf07a9ca31ece94ab68.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 23510
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig33-ivanti-establishing-rootkit.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_948091254.img.jpeg/1728623149502/ 67 KB
69 KB 47ms
47ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_948091254.img.jpeg/1728623149502/fig33-ivanti-establishing-rootkit.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

e91d19121fbf6ef08ec7ce270a07ef60a36ee454268228a0d698f666c2d9f359

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "10d87-6242c70bf2540"
Age: 40870
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Fq-AUa2vkpYhsNJA3wcPhnFl9YZOUSQqHNc11L1OzufbutBxfb8Heg==
Date: Tue, 15 Oct 2024 13:02:52 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:05:49 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 68999
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK fig34-ivanti-rootkit-persistence.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_89044911.img.jpeg/1728623190397/ 57 KB
58 KB 165ms
165ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_89044911.img.jpeg/1728623190397/fig34-ivanti-rootkit-persistence.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

931a1bc91c7b780d9df916bdbd551447e2b0d742a0ff1bdd7a6dbb5f42619b39

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "e339-6242c7330c180"
Age: 40871
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: slkRTz_Ajt7pFh_NS7pva2sU6ZH0CVOeipo94e4xet_BrC0SLZ0A8w==
Date: Tue, 15 Oct 2024 13:02:53 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 05:06:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 b74365e62a15568f4c1434d713851630.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 58169
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H/1.1 200
OK table04-ivanti-mitre-mapping.jpeg
www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_256695740.img.jpeg/1728661530772/ 94 KB
96 KB 64ms
41ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa/_jcr_content/root/responsivegrid/table_content/par/image_256695740.img.jpeg/1728661530772/table04-ivanti-mitre-mapping.jpeg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a127f5d38a4a71d09b04fe89ab3c7cea05b5d20997a702855f66bcf3c0393cd5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
ETag: "178fb-62435606eba80"
Age: 40870
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: aaxFL2R-iWGhqDUt326mpiJqFRlrvfyxdltp6xKcm7ccPCNjKSi9LQ==
Date: Tue, 15 Oct 2024 13:02:53 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 11 Oct 2024 15:45:30 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 bcb262a3e951c47276ddeac5e3baf150.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 96507
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.10.0/ 356 KB
78 KB 36ms
35ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Bh9exWOPGIwRshWljrtlEw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735260901BC
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 2649
x-content-type-options: nosniff
date: Tue, 15 Oct 2024 14:11:42 GMT
content-type: application/javascript
last-modified: Thu, 03 Dec 2020 02:43:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 04b50403-701e-0008-0c77-cd88f9000000
cf-ray: 8d3066609b46a314-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 79698
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/29891b98-4435-469c-84ae-791eaa28c9e1/ 99 KB
24 KB 37ms
37ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/29891b98-4435-469c-84ae-791eaa28c9e1/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

afb08ef7dbe14e004ba0b93079e3c465c7c6f9d1038518826c8513126aa29ba7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: MNDmBGowTSZoWMGG9p6/mg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC07DF2B168D13
age: 66788
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Wed, 16 Oct 2024 14:11:43 GMT
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/json
last-modified: Thu, 28 Dec 2023 19:57:06 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 1b52a830-301e-0056-5374-79c86c000000
cf-ray: 8d306661cc46a297-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24015
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/ 318 B
2 KB 47ms
41ms Other
image/vnd.microsoft.icon 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "13e-565c628eb6a00-gzip"
Age: 1011551
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: QC7mneR6dXahMAStvOLRAvEdLOOxghN1aZE8WfDrxAqlfP1jh6dp2Q==
Date: Fri, 04 Oct 2024 00:09:26 GMT
Content-Type: image/vnd.microsoft.icon
Last-Modified: Thu, 22 Feb 2018 05:17:28 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 dcdda2de0f9d7443c4c888a61edd2c22.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 133
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 13 KB
4 KB 49ms
33ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: W9e0YobmEbvdB0V9OmpQkw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D89735209A34D6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 61983
x-content-type-options: nosniff
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 9d92755c-601e-00d0-506b-cd2f28000000
cf-ray: 8d3066628d1fa297-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3329
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 45 KB
12 KB 52ms
35ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: zNsRoM1FEmsEgJoYMCNTng==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D897352245C4EA
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 44888
x-content-type-options: nosniff
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/json
last-modified: Thu, 03 Dec 2020 02:42:53 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ecfe8c79-601e-0080-574e-79c685000000
cf-ray: 8d3066628d22a297-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11755
x-ms-blob-type: BlockBlob
server: cloudflare

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 509 KB
122 KB 146ms
29ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 62ccea4549c1c360f561987e20bd929c475a5f596bc7731a224d99e0d253cfa0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "af0a8014ad3a875765ca4dd5d5ca9349:1728346478.684687"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 124284
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:38 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 id Show response
dpm.demdex.net/ 367 B
915 B 135ms
37ms XHR
application/json 18.209.0.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1729001503420

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.209.0.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-209-0-122.compute-1.amazonaws.com

Software

Resource Hash

67e31d0c68d13f39568b999b839a87be61a9b35a0d2d01212cbe5093edde095c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v065-009da736e.edge-va6.demdex.com 3 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: tJ7XAtoVRx8=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.fortinet.com
content-length: 310
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 dest5.html
fortinet.demdex.net/ Frame CCF3 0
0 219ms
49ms Document
text/html 34.235.33.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.235.33.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-235-33-249.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 15 Oct 2024 14:11:44 GMT
dcs: dcs-prod-va6-2-v065-0fbb76ae6.edge-va6.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 10 Oct 2024 10:02:53 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: hbSqrPwaRqA=

GET
H2

200

ibs:dpid=411&dpuuid=Zw54HwAAAMUIxwN_
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=61365736992321897700592417269413966323
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zw54HwAAAMUIxwN_

42 B
716 B

43ms
42ms

Image
image/gif

18.209.0.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zw54HwAAAMUIxwN_

Protocol

Server

18.209.0.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-209-0-122.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v065-009da736e.edge-va6.demdex.com 5 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: PNaSn4VLSxw=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zw54HwAAAMUIxwN_
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Tue, 15 Oct 2024 14:11:43 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

POST
H2 200 delivery Show response
fortinet.tt.omtrdc.net/rest/v1/ 351 B
840 B 333ms
45ms XHR
application/json 63.140.39.93
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.tt.omtrdc.net/rest/v1/delivery?client=fortinet&sessionId=8ce269d0a433440ba543363ccb4bf4b3&version=2.10.0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.93 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-93.data.adobedc.net

Software

jag /

Resource Hash

388a2ece7b8df4f997005cfb977be0e088c4909bf5c41cec6b5c98f68f911e34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 9069165b-414c-4420-844a-d217f07befbd
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://www.fortinet.com
date: Tue, 15 Oct 2024 14:11:43 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 35 KB
13 KB 26ms
24ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "d8232f86c8016a8e0acaa7ecfdf72b3e:1722493571.189276"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 13012
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 3 KB
2 KB 28ms
26ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "bb4b6453e3ab80111a2b227318d22efb:1722493571.614634"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1597
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 200 0786.js Show response
script.crazyegg.com/pages/scripts/0117/ 7 KB
3 KB 266ms
44ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eff032f2a7c04897a921492a9ce71e4fcbd047f1b2b487177955f000d6a182d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 88368
cf-polished: origSize=6996
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: text/javascript
last-modified: Mon, 14 Oct 2024 13:34:55 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d306667cde5ab10-YYZ
access-control-allow-origin: *
ce-version: 11.5.299
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 257ms
24ms Script
application/javascript 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111bb"
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 17:11:43 GMT
accept-ranges: bytes
content-length: 18819
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 28 KB
9 KB 255ms
26ms Script
application/x-javascript 23.51.57.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.51.57.192 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-192.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3ac2943bf8d9d7f8d3dfa505f1c382b028fa493ffb2e3e2145595815df4ee999

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Content-Encoding: gzip
ETag: "f41d7dee86b46fd9726c83903f0d6cbe:1728888767.088324"
Connection: keep-alive
Expires: Tue, 15 Oct 2024 14:31:43 GMT
Accept-Ranges: bytes
X-CC: CA
Content-Length: 8746
X-RG: NA
Date: Tue, 15 Oct 2024 14:11:43 GMT
Content-Type: application/x-javascript
Last-Modified: Mon, 14 Oct 2024 06:18:14 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 25f2dd15-02c6-4e7a-bc8b-c5722b49624d Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 265ms
34ms Script
application/javascript 34.86.70.109
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.86.70.109 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 109.70.86.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-request-id: F_6ltQzymXa0iKwjZQLE
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 269ms
49ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

c3be590171c0375d497714a608a5c4cd4e90e124e1c0cff1807cd8adb156e64b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "01973e1111cdb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 11A8FFABC9C44081B18EEE6E085645B2 Ref B: YMQ01EDGE0607 Ref C: 2024-10-15T14:11:43Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14538
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/javascript
last-modified: Fri, 11 Oct 2024 19:15:06 GMT
vary: Accept-Encoding

GET
H2 200 RCac955f2e1e97429197e1e31aaec22e86-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 1 KB
940 B 31ms
28ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCac955f2e1e97429197e1e31aaec22e86-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b0c24ca8333c5e792fdbb0d0a02529e99999ae19484c6e304c4cc8ce4535d485

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 683
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 9 KB
2 KB 28ms
25ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 450be4bf64305ebda12eebbbbdba85912e51497cbb52f921dab64a44310a16b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1844
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 358 B
483 B 29ms
27ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 608f95c0544308eaef8ee3554248e93e668f323fb954f584ddc12cd65947d251

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 227
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 703 B
683 B 29ms
27ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0d41c18875dbfc417ec3cdb20d698edd52b930504892fe1e3dd1c0f1ba9b42f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 426
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 365 KB
121 KB 295ms
78ms Script
application/javascript 2607:f8b0:4006:80c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

945064097c03c508a89cd8fd574bd597b4939675dda5bc76558c95be848f6030

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 122834
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 RC06cd6a06a307489f80febc787462cb12-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 635 B
642 B 28ms
27ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC06cd6a06a307489f80febc787462cb12-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 90a224ae782e3be06cc08cd0dea598ea22f91ee4635920cc77228326bb5409d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 385
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 2 KB
1011 B 33ms
31ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 03a0fcddc62f902b243bb6ed855041f4fa937340fd81d86552f672f24d6497da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 754
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7be3d22b2fd6487ca9390477738587fe-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 819 B
756 B 35ms
27ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC7be3d22b2fd6487ca9390477738587fe-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0d87642c368aa398fe4dd35af439768fb2c9167ba52f2b995eaa3d61598853a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC407b573180554ea6b11eecdc31ecbd3f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 819 B
756 B 33ms
25ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC407b573180554ea6b11eecdc31ecbd3f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5f7c381eca2f132069a8514789e46793cf6f5886b523ac91db7e33c41182248d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 499
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC8c594cd344f84ab89afc779d8f53fff4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 1 KB
811 B 34ms
27ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC8c594cd344f84ab89afc779d8f53fff4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2e963b4b8f73348a8de67ca3f24258b1bfc6874339867af3119bd8751ad9db79

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 554
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5915f5d7e33546579cd5fd510349ed90-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 722 B
715 B 34ms
28ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC5915f5d7e33546579cd5fd510349ed90-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 55efcd9c7c8dc07e65a641a23760facd1b95fa530876ac2d2766e3247764ad3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 458
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC1d92f04752ae42a38e54de48cb85adf4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 661 B
648 B 51ms
44ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC1d92f04752ae42a38e54de48cb85adf4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 661e67a6ed119b9a5bd08892caf68b0e794f68207156cd50f703d320ee6155ef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 391
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf940460311f349b5af69d075bdef61d4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 368 B
491 B 47ms
40ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCf940460311f349b5af69d075bdef61d4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c153cd2dff5ec3af05397a2fe0f7dc1eb7544b5858521dca8bf1c20e439d70d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 234
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 754 B
704 B 46ms
40ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f46a9869eb1b18c3d0274a6ab46008bb2cfaa73cc3fbb25df8e2d6085ad706da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 447
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 2 KB
970 B 45ms
40ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1bfc3fec636bdfc92ca324c43dc9382d5f1567b0cb29f806202c2ee530173b7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 713
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 1021 B
856 B 44ms
40ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8c0aa54f351ccf9f614ac7519cec00ae1f40db7bbea8c7dd2fb51538a8d9b272

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 600
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcd84e40d19c24776bef77836ab2f8df6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 819 B
757 B 44ms
41ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4e9aa67ca1f1ffe2c11e722079a58f1be803c9378468d6c019be53b1ffd26c6b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 501
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 388 B
498 B 45ms
42ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9636ce7f4b06bd40058b0417691448095e6490a3b518fbdeac3e104023fd9b92

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 242
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5c60a51709a94068afbf065e1448b617-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 664 B
656 B 47ms
45ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC5c60a51709a94068afbf065e1448b617-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c50c3a763973b8bc75e126c3f104f84a728f8febf50faa7e37685e86fa1e2c1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 400
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 2 KB
981 B 46ms
44ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a23b68a0964626bb4062bf726dd4ab52d438dcfb88991402b224146d1087d1a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 724
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/ 966 B
808 B 46ms
44ms Script
application/x-javascript 2600:141b:1c00:209a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/ab0aba23da95/RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:209a::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 18e04370c6f2bee61d32771663e6b0408e1627bb89a3894457941fa19ad83000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "225c19abfa23b85abbde0df936bb4145:1728346480.074291"
expires: Tue, 15 Oct 2024 15:11:43 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 551
date: Tue, 15 Oct 2024 14:11:43 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Oct 2024 00:14:40 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H/1.1 200
OK unifiedPixel Show response
tr.outbrain.com/ 53 B
321 B 161ms
28ms Fetch
image/gif 64.202.112.191
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?au=false&bust=021031620150466446&referrer=&cht=ot&marketerId=00ad3119690e692fd6990245f9741ea8f1&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&g=0&obApiVersion=1.1&obtpVersion=2.0.5

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

64.202.112.191 , United States, ASN23352 (SERVERCENTRAL, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 54
content-encoding: br
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: image/gif;
x-traceid: 7153b280fce77085ad9ee78571f54788

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 163ms
30ms Script
application/javascript 64.202.112.191
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

64.202.112.191 , United States, ASN23352 (SERVERCENTRAL, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 39
content-encoding: br
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript
x-traceid: b2b4077dbdc14b58d740e4cbeca37544

GET
H/1.1 200
OK 00ad3119690e692fd6990245f9741ea8f1 Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
516 B 165ms
25ms Script
text/html 23.51.57.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.51.57.192 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-51-57-192.deploy.static.akamaitechnologies.com

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
Cache-Control: max-age=60
ob-sent-time: 1728929156601
Content-Encoding: gzip
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Expires: Tue, 15 Oct 2024 14:12:44 GMT
Access-Control-Allow-Origin: *
X-CC: CA
Content-Length: 22
X-RG: NA
Date: Tue, 15 Oct 2024 14:11:44 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
x-traceid: 865225c7c83eb871afc3c0543daf331a

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 95ms
25ms Fetch
text/html 23.51.57.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.51.57.192 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-192.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Connection: keep-alive
Observe-Browsing-Topics: ?1
Expires: Tue, 15 Oct 2024 14:31:44 GMT
Access-Control-Allow-Origin: *
X-CC: CA
Content-Length: 26
X-RG: NA
Date: Tue, 15 Oct 2024 14:11:44 GMT
Content-Type: text/html

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/site/ 10 KB
2 KB 83ms
53ms XHR
application/json 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f5f608153dad93ff75e36a1530e737c204320e4c67f5370335477fb22296bc9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 88368
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/json
last-modified: Mon, 14 Oct 2024 13:34:56 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d3066685beaa1ed-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1805
ce-version: 11.5.299
server: cloudflare

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 36ms
24ms XHR
text/html 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-34-59-33.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.fortinet.com
content-length: 7
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 20 B
311 B 96ms
23ms XHR
text/html 2600:141b:1c00:2e::17d1:48c5
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:2e::17d1:48c5 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 9bcee3d09d7d09a58692fd63b04efbfa862832a4a5b89e360cf4ae0f556c66b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2607:5300:60:7867::9
expires: Tue, 15 Oct 2024 14:11:44 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729001504136_399550021_411458639_12_446_22_28_219";dur=1
access-control-allow-origin: https://www.fortinet.com
content-length: 20
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 43ms
34ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=df60f9aa-4604-4bba-8d54-9853b2caaf17&session=1142e5c5-b03f-4609-8500-7468ae68b9b7&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A44%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=3791cefb-2339-4629-8041-c3f35fb92078&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:44 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 43ms
35ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=df60f9aa-4604-4bba-8d54-9853b2caaf17&session=1142e5c5-b03f-4609-8500-7468ae68b9b7&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2015%20Oct%202024%2014%3A11%3A44%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%225eeecf22b2d12a77a14639dce97b7a36%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2015%20Oct%202024%2014%3A11%3A44%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2015%20Oct%202024%2014%3A11%3A44%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2015%20Oct%202024%2014%3A11%3A44%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227381d1d7c753fe2d8e217c3fdc44c0f17418dcc4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2015%20Oct%202024%2014%3A11%3A44%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=3791cefb-2339-4629-8041-c3f35fb92078&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:44 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET p
i.simpli.fi/ 0
0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 316 KB
105 KB 69ms
62ms Script
application/javascript 2607:f8b0:4006:80c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d52a2d3a220f08a4d29008b71f2a760b08a891816e3f8a6e898c53b5c3ea5fca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 107208
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 2780555e46c3031ae97407e9c52b4705.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 105 KB
36 KB 36ms
35ms Script
text/javascript 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61917dc4b13b887a30af978c934892e7db4329ba72bbd655635613b537d760e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 88620
cf-polished: origSize=107371
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: text/javascript
last-modified: Tue, 08 Oct 2024 19:20:03 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
cf-ray: 8d306668cec1ab10-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 17532650.js Show response
bat.bing.com/p/action/ 370 B
424 B 47ms
47ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17532650.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

fce461e0fefe1d6d687b3eab8304d3affaf23fb674b18bfb5242ccfc544e1bb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8F437E7A1373423FA369B8B80146D557 Ref B: YMQ01EDGE0607 Ref C: 2024-10-15T14:11:44Z
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 33ms
32ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=df60f9aa-4604-4bba-8d54-9853b2caaf17&session=1142e5c5-b03f-4609-8500-7468ae68b9b7&event=ipv6&q=%7B%22address%22%3A%222607%3A5300%3A60%3A7867%3A%3A9%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=3791cefb-2339-4629-8041-c3f35fb92078&ipv6=2607%3A5300%3A60%3A7867%3A%3A9&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:44 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 256 KB
90 KB 67ms
66ms Script
application/javascript 142.250.80.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.104 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

beb07659642dc0e2fb0d2e7c13f71388ef3ceda13433e13a4e489d2c4826f506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 15 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92572
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 73ms
72ms Script
application/javascript 142.250.80.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.104 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ca71dd5e442ec07b69d4efd7eb32df28ba6465c47f4bf1ef2f9c4c941e29b386

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 15 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81513
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 237 KB
85 KB 108ms
107ms Script
application/javascript 142.250.80.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.104 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

09cb9d110b661c309dff74e762e8b279de370dd6b05218c3abc1142171bfb903

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 15 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 87060
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
88 KB 111ms
110ms Script
application/javascript 142.250.80.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.104 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

feeeb4d4ea1cd6b99ca3730bdd88961f0ac2293455cd42e5977e7c41f9e209ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 15 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90255
x-xss-protection: 0
server: Google Tag Manager

POST
H3 200 collect
www.google.com/ccm/ 0
0 557ms
56ms Ping
text/html 142.250.64.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&scrsrc=www.googletagmanager.com&frm=0&rnd=1649148942.1729001504&auid=572786102.1729001504&npa=0&gtm=45be4a90v9123037237za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&tft=1729001504343&tfd=2536&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.64.68 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s30-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

GET
H2 204 0
bat.bing.com/action/ 0
359 B 61ms
44ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=fa09d5eb-3d2a-499a-8879-b35997b3bac6&bo=1&sid=685a6a708aff11efaafba10a02499430&vid=685cd4008aff11efb2d2152b88874101&vids=1&msclkid=N&pi=918639831&lg=en-CA&sw=1600&sh=1200&sc=24&tl=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&kw=FortiGuard%20Labs%20Threat%20Research,zero-day%20vulnerability&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&r=&lt=949&pt=1729001501807,,,,,0,1,40,41,309,77,311,356,393,373,719,719,772,949,949,949&pn=0,0&evt=pageLoad&sv=1&cdb=AQET&rn=938642

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FE638956B4A648EE9718C00166579079 Ref B: YMQ01EDGE0607 Ref C: 2024-10-15T14:11:44Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:44 GMT

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 632 B
579 B 131ms
73ms XHR
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: c622695ef459045b51c41af2aabcd78b04fa7f8a8e55267f7d3568fb230fe537

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.fortinet.com
content-length: 319
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/json
vary: Origin, Accept-Encoding

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/sampling/ 46 B
297 B 40ms
37ms XHR
application/json 104.19.148.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/sampling/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29d6b32f545f36a29ab83a4be5f92d4ebfb43a6dcc6457f7681a8478e5e8ea6c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 88366
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/json
last-modified: Mon, 14 Oct 2024 13:34:56 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8d30666ade19a1ed-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 65
ce-version: 11.5.299
server: cloudflare

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 389ms
46ms Fetch
text/plain 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-38BQ9XFDT4&gtm=45je4a90v9191763579za200&_p=1729001503748&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101686685&cid=1368671678.1729001504&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1729001504&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&dt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2701
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 47 KB
17 KB 437ms
50ms Script
application/javascript 2a02:6ea0:c454::1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-NY1-885 /
Resource Hash: 96fa0a3199b1184d9aab3b1a117e7b88974daff72641aee7f50b44f80d404aa4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "6707e1b1-bb6c"
cdn-fileserver: 749
date: Tue, 15 Oct 2024 14:11:44 GMT
cdn-storageserver: NY-346
last-modified: Thu, 10 Oct 2024 14:16:17 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 10/12/2024 23:29:28
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: a807126b155c404612f207e51822ab18
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-triggerededgerule: a507b864-43b8-4277-b8aa-201eb3fa4d9d, 312b8174-53bc-4228-b69f-a97dfd5b1241, 312b8174-53bc-4228-b69f-a97dfd5b1241
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 6 KB
2 KB 346ms
66ms Script
text/javascript 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1729001504558&cv=11&fst=1729001504558&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f2.1e100.net

Software

cafe /

Resource Hash

e7a3eeb1ea3a3dde88a707fe6053d0074c8979df17db1bd6bbe8bae79377e6b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2420
date: Tue, 15 Oct 2024 14:11:44 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 662878185
td.doubleclick.net/td/rul/ Frame DBD4 0
0 410ms
68ms Document
text/html 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/662878185?random=1729001504558&cv=11&fst=1729001504558&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=10050195;npa=0;auiddc=572786102.1729001504;ps=1;pcor=1963096138;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=1...
td.doubleclick.net/td/fls/rul/ Frame 55CE 0
0 474ms
138ms Document
text/html 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=572786102.1729001504;ps=1;pcor=1963096138;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;src=10050195;npa=0;auiddc=572786102.1729001504;ps=1;pcor=1963096138;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l...
ad.doubleclick.net/ 42 B
65 B 324ms
92ms Image
image/gif 142.250.65.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;src=10050195;npa=0;auiddc=572786102.1729001504;ps=1;pcor=1963096138;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Tue, 15 Oct 2024 14:11:44 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET activity;register_conversion=1;src=10050195;npa=0;auiddc=572786102.1729001504;ps=1;pcor=1963096138;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123...
ad.doubleclick.net/ 0
0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/ 6 KB
2 KB 201ms
60ms Script
text/javascript 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/?random=1729001504701&cv=11&fst=1729001504701&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f2.1e100.net

Software

cafe /

Resource Hash

4a42cb5f0ad29da9aee1a9f82f940d790c2b242ec4ae29bac91d7fb14990af6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2413
date: Tue, 15 Oct 2024 14:11:44 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 729495989
td.doubleclick.net/td/rul/ Frame 3E3F 0
0 402ms
69ms Document
text/html 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/729495989?random=1729001504701&cv=11&fst=1729001504701&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 6 KB
2 KB 146ms
66ms Script
text/javascript 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1729001504766&cv=11&fst=1729001504766&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f2.1e100.net

Software

cafe /

Resource Hash

2a880e90aa41697d0998bcebc3f454fbf9640deb91d3fb0da283e6b3f7ce3c66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2413
date: Tue, 15 Oct 2024 14:11:44 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 609297413
td.doubleclick.net/td/rul/ Frame C530 0
0 390ms
67ms Document
text/html 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/609297413?random=1729001504766&cv=11&fst=1729001504766&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 512ms
31ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Tue, 15 Oct 2024 14:11:44 GMT
timing-allow-origin: https://6sense.com
x-6si-region

POST
H2 200 clock Show response
tracking.crazyegg.com/ 41 B
147 B 107ms
66ms XHR
text/plain 3.135.83.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1729001504860&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2780555e46c3031ae97407e9c52b4705.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.135.83.200 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-135-83-200.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 770c9baa68a917d800fb4cbae51eaaf337807ff7f93f6a018e952c13d90ea84c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store
access-control-allow-origin: *
content-length: 41
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: text/plain
server: awselb/2.0

GET
H3 200 /
www.google.com/pagead/1p-user-list/729495989/ 42 B
64 B 66ms
59ms Image
image/gif 142.250.64.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/729495989/?random=1729001504701&cv=11&fst=1729000800000&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfeTM_bwVHS2bwzThq30VNDz_C-5NcJw&random=156867369&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.68 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 15 Oct 2024 14:11:44 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.ca/pagead/1p-user-list/729495989/ 42 B
64 B 331ms
56ms Image
image/gif 142.250.64.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/729495989/?random=1729001504701&cv=11&fst=1729000800000&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfeTM_bwVHS2bwzThq30VNDz_C-5NcJw&random=156867369&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 15 Oct 2024 14:11:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/662878185/ 42 B
64 B 60ms
54ms Image
image/gif 142.250.64.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/662878185/?random=1729001504558&cv=11&fst=1729000800000&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfR3citHw7f3nJlg3uJzcZgSQRQjUgKw&random=113191231&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.68 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 15 Oct 2024 14:11:44 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.ca/pagead/1p-user-list/662878185/ 42 B
64 B 330ms
58ms Image
image/gif 142.250.64.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/662878185/?random=1729001504558&cv=11&fst=1729000800000&bg=ffffff&guid=ON&async=1&gtm=45be4a90v887005625za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfR3citHw7f3nJlg3uJzcZgSQRQjUgKw&random=113191231&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 15 Oct 2024 14:11:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
64 B 55ms
49ms Image
image/gif 142.250.64.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1729001504766&cv=11&fst=1729000800000&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfXntd90XoP_tYrr2zywQ-7WrNCyAmdA&random=444414719&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.68 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 15 Oct 2024 14:11:44 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.ca/pagead/1p-user-list/609297413/ 42 B
64 B 322ms
57ms Image
image/gif 142.250.64.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/609297413/?random=1729001504766&cv=11&fst=1729000800000&bg=ffffff&guid=ON&async=1&gtm=45be4a90za200zb9123037237&gcd=13l3l3l3l1l1&dma=0&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&hn=www.googleadservices.com&frm=0&tiba=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=572786102.1729001504&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfXntd90XoP_tYrr2zywQ-7WrNCyAmdA&random=444414719&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 15 Oct 2024 14:11:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

OPTIONS
H2 204 clock
tracking.crazyegg.com/ Frame 0
0 436ms
62ms Preflight 3.135.83.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1729001504860&tk=329ee1373036c5ddcda74cf257baa0a6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.135.83.200 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-135-83-200.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public, max-age=86400
date: Tue, 15 Oct 2024 14:11:45 GMT
server: awselb/2.0
vary: Access-Control-Request-Headers, Origin, Access-Control-Request-Method

GET
H2 200 api.min.css
a.omappapi.com/app/js/ 10 KB
3 KB 327ms
81ms Stylesheet
text/css 2a02:6ea0:c454::1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-NY1-885 /
Resource Hash: a4db214a51d8aa0b6a55aab329c983c0dba1976db88c499c75410392e220f9e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "6707e1c2-2644"
cdn-fileserver: 749
date: Tue, 15 Oct 2024 14:11:45 GMT
cdn-storageserver: NY-427
last-modified: Thu, 10 Oct 2024 14:16:34 GMT
content-type: text/css
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 10/12/2024 23:29:28
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: f7aaa9f1461fc62fad3db929e05198f3
cdn-pullzone: 293267
cdn-proxyver: 1.04
access-control-allow-origin: *
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

GET
H2 401 39852 Show response
api.omappapi.com/v2/embed/ 165 B
592 B 318ms
82ms XHR
application/json 2606:4700:3108::ac42:2af8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2af8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-user-agent: standard--
cf-cache-status: DYNAMIC
expires: Tue, 15 Oct 2024 14:13:30 GMT
x-cache: Error from cloudfront
x-amz-cf-id: jobK9O9tmbPqB_3d3wgMaMsLG2untCT4Gh3wqfK0-Habazsb1CDTLg==
date: Tue, 15 Oct 2024 14:11:45 GMT
x-cache-config: 0 0
content-type: application/json
vary: Accept-Encoding, User-Agent
access-control-allow-headers: X-CSRF-Token
cache-control: public, max-age=120, stale-while-revalidate=1800
via: 1.1 6bc96fcd042709dbc96cdeb6eb80307c.cloudfront.net (CloudFront)
cf-ray: 8d30666fcb0c7142-YUL
access-control-allow-origin: *
content-length: 165
x-amz-cf-pop: YUL62-C1
server: cloudflare

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 312ms
81ms Script
text/javascript 2606:4700::6812:1247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1247 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 56366
via: 1.1 google
cf-ray: 8d30666fc9326e05-YUL
expires: Tue, 15 Oct 2024 14:31:45 GMT
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK tag.js Show response
abm-tracking.demandscience.com/ 2 KB
2 KB 412ms
97ms Script
application/javascript 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/tag.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: public, max-age=0
ETag: W/"82b-18f5d3a3d78"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2091
Date: Tue, 15 Oct 2024 14:11:45 GMT
Content-Type: application/javascript; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Thu, 09 May 2024 12:00:49 GMT

GET
H2 200 wid.tracker.js Show response
tmp.argusplatform.com/js/ 8 KB
3 KB 400ms
139ms Script
text/javascript 2620:1ec:29:1::35
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://tmp.argusplatform.com/js/wid.tracker.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:29:1::35 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preloadmax-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preloadmax-age=31536000
cache-control: public, must-revalidate, max-age=30
x-dns-prefetch-control: off
content-encoding: br
etag: "28476869"
referrer-policy: same-origin
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:45 GMT
x-xss-protection: 1; mode=block
content-type: text/javascript
last-modified: Sat, 08 Jun 2024 11:51:22 GMT
vary: Accept-Encoding
x-azure-ref: 20241015T141145Z-159587bfd64576sn0upt2n4kt40000000740000000001gbf

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ 161 B
711 B 288ms
84ms Script
text/javascript 74.121.140.211
PAEDAE-INC

General

Check archive.org

Show headers Download Go to

Full URL

https://pixel.mathtag.com/event/js?mt_id=1629896&mt_adid=260855&mt_exem=&mt_excl=&v2=&v3=&s1=&s2=&s3=&v1=en:blog:threat-research:burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.121.140.211 Reston, United States, ASN30419 (PAEDAE-INC, US),

Reverse DNS

Software

MT3 1668 f41eadd master iad iad-pixel-x32 config_version:"380" /

Resource Hash

98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457

Security Headers

Name	Value
Strict-Transport-Security	31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Strict-Transport-Security: 31536000
Cache-Control: no-cache
Content-Encoding: gzip
Connection: close
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Tue, 15 Oct 2024 14:11:45 GMT
X-XSS-Protection: 0
Content-Type: text/javascript
Server: MT3 1668 f41eadd master iad iad-pixel-x32 config_version:"380"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 323 KB
107 KB 110ms
110ms Script
application/javascript 142.250.80.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.104 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

9d475d9ddb409c9ce04da90006e5bf42b07adfa9e8acb3bf53a4d1de9f6736ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 15 Oct 2024 14:11:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 109485
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK spx Show response
dx.mountain.com/ 23 KB
6 KB 284ms
55ms Script
application/javascript 52.7.151.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=11119047117937764term=value
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.7.151.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-7-151-245.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: eae6da286f3f96b496b9b8f1e86c571f7e53f3ac5d4e1cd7a83ea8cf19af97e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 2
expires: Thu, 01 Jan 1970 00:00:00 GMT
be: spx-prod
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript;charset=utf-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: istio-envoy

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 237ms
35ms Script
application/javascript 146.75.28.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip"
accept-ranges: bytes
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Tue, 15 Oct 2024 14:11:45 GMT
x-tw-cdn: FT
last-modified: Fri, 15 Mar 2024 03:07:08 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kiad7000140-IAD
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 223ms
26ms Script
application/javascript 2600:141b:1c00:6::17df:d120
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:6::17df:d120 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=69859
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Tue, 15 Oct 2024 14:11:45 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 22 KB
7 KB 178ms
32ms Script
text/javascript 34.196.140.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.140.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-140-205.compute-1.amazonaws.com
Software: /
Resource Hash: 1aa2c530c01922a6c5b5b2f260995f54ad56fe3a991bf5a9bf59962a04950f4c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: max-age=5
content-encoding: gzip
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: text/javascript

GET
H2 200 iztag.js Show response
tags.inzynk.io/0ulh3gex/ 34 B
442 B 145ms
24ms Script
application/octet-stream 2600:9000:2512:7400:12:dfa9:e200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.inzynk.io/0ulh3gex/iztag.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2512:7400:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding
x-amz-version-id: 15XT7F8rursoJ6jHrhKIXrYdXTZkWasY
etag: "595f7fa79bc22a7029d2751228622eb4"
age: 75060
via: 1.1 80f517c5ec4d986c177bb1a50f8c9156.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 34
x-amz-cf-id: i3j58fgWIJ_YkGs526qHbcngEymcJiHpNeDUcdZpXqsGsLLXHyPldQ==
date: Mon, 14 Oct 2024 17:21:30 GMT
content-type: application/octet-stream
last-modified: Thu, 05 Sep 2024 13:11:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P7
x-amz-server-side-encryption: AES256

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1773420&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

43 B
1 KB

44ms
32ms

Image
image/gif

68.67.160.137
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Protocol

Server

68.67.160.137 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 167.114.209.103; 167.114.209.103; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: c1a63ccc-1253-4b5e-8574-e0f383f0f77a
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:45 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 167.114.209.103; 167.114.209.103; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: f265563f-af12-4a77-ac8e-79eddcd8f64b
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:45 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?add=36113683
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

43 B
1 KB

55ms
48ms

Image
image/gif

68.67.161.208
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Protocol

Server

68.67.161.208 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 167.114.209.103; 167.114.209.103; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 126db4f2-c472-4323-a3b5-04dd348eb49f
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:45 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 167.114.209.103; 167.114.209.103; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 716bb01a-91ce-4373-ab3e-15a3ef1a37d7
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:45 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1 200
OK footer-links.json Show response
www.fortinet.com/content/dam/fortinet-blog/ 310 KB
36 KB 71ms
59ms XHR
application/json 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/footer-links.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "4d8dc-61d89b0f78340-gzip"
Age: 7674397
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 9GAJdGqJ-NL0S38pnPWBxMT2PdtRzRdhq-0g8_79kqrF320cwv4Ggw==
Date: Tue, 15 Oct 2024 00:12:10 GMT
Content-Type: application/json
Vary: Accept-Encoding
Last-Modified: Thu, 18 Jul 2024 18:24:37 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 c813b6a2744af01ddcd5259923d9b0fa.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 35378
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P4
Server: Apache

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 46ms
33ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=df60f9aa-4604-4bba-8d54-9853b2caaf17&session=1142e5c5-b03f-4609-8500-7468ae68b9b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A44%20GMT%22%2C%22timeSpent%22%3A%221020%22%2C%22totalTimeSpent%22%3A%221020%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=3791cefb-2339-4629-8041-c3f35fb92078&ipv6=2607%3A5300%3A60%3A7867%3A%3A9&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:45 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 s26192079599955
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/ 43 B
372 B 129ms
33ms Image
image/gif 63.140.39.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LEWM/s26192079599955?AQB=1&ndh=1&pf=1&t=15%2F9%2F2024%207%3A11%3A45%202%20420&sdid=7153E10C28761EFD-5B32F97BCEF51BC7&mid=61742584658573016980630101830149066875&aamlh=7&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Aburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cc=USD&events=event3&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&v3=%2B1&c7=Entire%20Site&c8=New&v25=61742584658573016980630101830149066875&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Aburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&v97=Faisal%20Abdul%20Malik%20Qureshi%2C%20John%20Simmons%2C%20Jared%20Betts%2C%20Luca%20Pugliese%2C%20Trent%20Healy%2C%20Ken%20Evans%20and%20Robert%20Reyes&v98=October%2011%2C%202024&v106=Montreal&v107=Quebec&v108=Canada&v126=NA&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.65 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-65.data.adobedc.net

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
pragma: no-cache
etag: 3713002460058550272-4618514983681423715
x-content-type-options: nosniff
expires: Mon, 14 Oct 2024 14:11:45 GMT
access-control-allow-origin: *
p3p: CP="This is not a P3P policy"
content-length: 43
date: Tue, 15 Oct 2024 14:11:45 GMT
x-xss-protection: 1; mode=block
last-modified: Wed, 16 Oct 2024 14:11:45 GMT
vary: *
server: jag
content-type: image/gif;charset=utf-8

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 67ms
59ms Fetch
text/plain 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-JH142QCQCJ&gtm=45je4a90v893708426za200zb9123037237&_p=1729001503748&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101686685&cid=1368671678.1729001504&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1729001505&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&dt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_ss=1&_ee=1&tfd=3541
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
1 KB 198ms
105ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=7120%2C2159050%2C4628290%2C6313418&time=1729001505388&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
x-li-fabric: prod-lor1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
access-control-allow-methods: GET, OPTIONS
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/json
access-control-allow-headers: *
x-li-pop: afd-prod-lor1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-fs-uuid: 00062484888d9711caf399450915eeba
x-msedge-ref: Ref A: FB0239ED1D0C474D86B8D8C6A11BD95D Ref B: YMQ01EDGE0315 Ref C: 2024-10-15T14:11:45Z
x-restli-protocol-version: 1.0.0
x-li-uuid: AAYkhIiNlxHK85lFCRXuug==
access-control-allow-origin: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001505388&li_adsId=d00ac2ec-0178-4a13-abed-3d7a242e6152&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001505388&li_adsId=d00ac2ec-0178-4a13-abed-3d7a242e6152&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Ft...

0
265 B

213ms
117ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001505388&li_adsId=d00ac2ec-0178-4a13-abed-3d7a242e6152&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&e_ipv6=AQL7CDM3cHdGaQAAAZKQhUL__M84N-g19CrhH92YLcrEcHcJ44-1O2xRtu0U3Afs94Lvgb6m
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 3B2E47A0284F42A8A642B59BE3765A3E Ref B: YMQ01EDGE0317 Ref C: 2024-10-15T14:11:45Z
x-li-fabric: prod-lor1
x-li-uuid: AAYkhIiRNJo41qAysHGHOA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 15 Oct 2024 14:11:44 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1729001505388&li_adsId=d00ac2ec-0178-4a13-abed-3d7a242e6152&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&e_ipv6=AQL7CDM3cHdGaQAAAZKQhUL__M84N-g19CrhH92YLcrEcHcJ44-1O2xRtu0U3Afs94Lvgb6m
x-msedge-ref: Ref A: 6A592656DA6747B18AD4D64CB2708E46 Ref B: YMQ01EDGE0308 Ref C: 2024-10-15T14:11:45Z
x-li-fabric: prod-lor1
x-li-uuid: AAYkhIiNnAYz2f3CJm2IMw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 15 Oct 2024 14:11:44 GMT

GET
H2 200 adsct
t.co/i/ 43 B
629 B 163ms
77ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=b72eb809-48e5-42e9-8ad3-dc33b33277b8&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=37a263d2-e74c-452f-9592-e51f1dabedfd&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 46382d071bc8b6ba
cache-control: no-cache, no-store, max-age=0
x-connection-hash: b6b15769024d868d0d44852f920687f430506e42eaf0a1ee0620938e629c0cbd
cf-cache-status: DYNAMIC
cf-ray: 8d3066715c7aac82-YYZ
x-response-time: 7
content-length: 43
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
213 B 171ms
55ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=b72eb809-48e5-42e9-8ad3-dc33b33277b8&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=37a263d2-e74c-452f-9592-e51f1dabedfd&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: ce523f4e3302b3e2
cache-control: no-cache, no-store, max-age=0
x-connection-hash: e00059ebf5bd65d614247fee1329516750daa3acbcbd29651e3c96270e536450
x-response-time: 7
content-length: 43
date: Tue, 15 Oct 2024 14:11:45 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 adsct
t.co/i/ 43 B
467 B 203ms
143ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=6351772e-4253-40f8-8eae-f4c28bfc76ab&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=37a263d2-e74c-452f-9592-e51f1dabedfd&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 953d84041b575912
cache-control: no-cache, no-store, max-age=0
x-connection-hash: b00a0f4ff4d56ee9750b6d2b823b2ab7cdcf4ac7e347cf856e2a358ec1abc6ec
cf-cache-status: DYNAMIC
cf-ray: 8d3066715c7cac82-YYZ
x-response-time: 80
content-length: 43
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
392 B 154ms
51ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=6351772e-4253-40f8-8eae-f4c28bfc76ab&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=37a263d2-e74c-452f-9592-e51f1dabedfd&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: e6985ee6ae1decfb
cache-control: no-cache, no-store, max-age=0
x-connection-hash: e00059ebf5bd65d614247fee1329516750daa3acbcbd29651e3c96270e536450
x-response-time: 5
content-length: 43
date: Tue, 15 Oct 2024 14:11:45 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
446 B 62ms
57ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1729001505397&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
ibc_rate_tier: 1247773
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Tue, 15 Oct 2024 15:11:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AHmUCY2dJZi0TgGaLg1Wssja0fMMajnm0w3kMJw_FzO86_3d4nMDq45PFqbcohAbgXsNqjLq5Vcfk4JJ8Q
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 104ms
44ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1729001505397&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 15 Oct 2024 14:11:45 GMT
expires: Tue, 15 Oct 2024 14:11:45 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AHmUCY2T7qJs_gsO3quUS8D1Uk5cE7lxlZmu8Hd4COjh1tbu36FJ1oVwO5I_BWQGOadfB2G93C6bUOaqag

GET
H/1.1 200
OK is Show response
52.22.50.55/ 32 B
437 B 140ms
36ms Fetch
text/plain 52.22.50.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://52.22.50.55/is?cb=1729001505404
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=11119047117937764term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.22.50.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-50-55.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: 47b269a1d6b45c240f78bdac74f774b82ebab14a5ae05a80da9174f333e7daac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 1
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
content-length: 32
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: text/plain;charset=utf-8
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 401 / Show response
pixels.argusplatform.com/wh/track/ 205 B
468 B 493ms
365ms XHR
application/json 2620:1ec:29:1::35
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1729001505764717722&event_type=page_request&timestamp=1729001505&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:29:1::35 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20241015T141145Z-174b7fcd4f8vk24vwf7kt19yd800000006a0000000001k8u

GET
H2 200 fp.min.js Show response
cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/ 33 KB
14 KB 69ms
15ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY"
age: 1114
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220049-FRA, cache-yul1970030-YUL
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13749
x-jsd-version: 3.4.2

GET
H2 200 site-visitors Show response
intentstream.contanuity.com/api/ 115 B
374 B 102ms
101ms Fetch
application/json 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-pixel-auth: true
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=15724800; includeSubdomains
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 115
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/json; charset=utf-8
vary: origin
server: nginx

OPTIONS
H2 200 site-visitors
intentstream.contanuity.com/api/ Frame 0
0 322ms
92ms Preflight 44.226.187.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-pixel-auth
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-pixel-auth
access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
content-length: 0
date: Tue, 15 Oct 2024 14:11:45 GMT
server: nginx
strict-transport-security: max-age=15724800; includeSubdomains

GET
H2

200

burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=7278221...
10104846.fls.doubleclick.net/activityi;dc_pre=CNe7u8TIkIkDFfWbjggdWVUx_g;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/ Frame 5A44
Redirect Chain

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-iva...
https://10104846.fls.doubleclick.net/activityi;dc_pre=CNe7u8TIkIkDFfWbjggdWVUx_g;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-...

0
0

134ms
132ms

Document
text/html

172.217.165.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10104846.fls.doubleclick.net/activityi;dc_pre=CNe7u8TIkIkDFfWbjggdWVUx_g;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=7278221554572.3545?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lax30s03-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 2140
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:45 GMT
expires: Tue, 15 Oct 2024 14:11:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 15 Oct 2024 14:11:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10104846.fls.doubleclick.net/activityi;dc_pre=CNe7u8TIkIkDFfWbjggdWVUx_g;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=7278221554572.3545?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 227 KB
58 KB 80ms
28ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

Resource Hash

91aff3588efba0074124bbd204b45de0da882a853f29a1d73f7ec132291c5651

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=26, rtx=0, c=23, mss=1232, tbw=4429, tp=9, tpl=0, uplat=2, ullat=-1
pragma: public
x-fb-debug: MjXj/gmVC/hw8XGiGi6TufMnv7QbUZXOEudgKMxdMJ7Z/Yh1SivFSiiTwAeGb8RkYDPg1aba+pekfaVRcLN9PA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 59352
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 siteanalyze_6033413.js Show response
siteimproveanalytics.com/js/ 38 KB
12 KB 297ms
245ms Script
application/javascript 172.67.163.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6033413.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.163.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-cache-status: REVALIDATED
etag: "8451e15415563cef4e816d6dd250d58a"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BRq0uZDxdekPMoc0iRXu3DYiCcYcfB98k1gKCc757VXEA%2B06wBV1ognrIAgTkgcpYt3VmcaioJYWQCzN7aiQ3xmgEX5WLYxptDgPFLDpQdfOclRNzJLFOs75Vg2Ww6bcQ0AUnHpOHQvCOEo%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 03 Sep 2024 18:55:37 GMT
vary: Accept-Encoding
x-amz-id-2: QMh8dseMTZcpn4tXKGfF2Zsx+TSWlcRneW4/u3o65BsSL0++5y65LB1mrpKm5oHcqfFKZjlsvgw=
cache-control: max-age=86400, no-transform
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 9SJYW9V32F714TMG
cf-ray: 8d306671aec7b408-YYZ
accept-ranges: bytes
content-length: 11550
server: cloudflare

GET
H2 200 adsct
t.co/i/ 43 B
470 B 151ms
150ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=d29113c1-ef88-4c4d-a020-a2b1a5130077&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=37a263d2-e74c-452f-9592-e51f1dabedfd&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 9f5314ec0e62c1d8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: d305b1762e5583e1deb7a6be8bba19de6fc93542dc60184d7fd3bb48e23e89d3
cf-cache-status: DYNAMIC
cf-ray: 8d3066715c88ac82-YYZ
x-response-time: 87
content-length: 43
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
234 B 97ms
52ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=d29113c1-ef88-4c4d-a020-a2b1a5130077&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=37a263d2-e74c-452f-9592-e51f1dabedfd&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 44ad57e055147e6a
cache-control: no-cache, no-store, max-age=0
x-connection-hash: e00059ebf5bd65d614247fee1329516750daa3acbcbd29651e3c96270e536450
x-response-time: 5
content-length: 43
date: Tue, 15 Oct 2024 14:11:44 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 35ms
30ms Stylesheet
text/css 34.196.140.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.140.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-140-205.compute-1.amazonaws.com
Software: /
Resource Hash: 629dea3fc8ca3364508e787cddbe7e6a1e0e72071d9ba2ba4539a2c60c8f1dea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 91ms
28ms Fetch
image/jpeg 34.196.140.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.140.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-140-205.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: image/jpeg

GET
BLOB 200
OK d02087bd-195d-463f-823e-e6ec9e287641
https://www.fortinet.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.fortinet.com/d02087bd-195d-463f-823e-e6ec9e287641
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H3 200 177020962864941 Show response
connect.facebook.net/signals/config/ 66 KB
13 KB 27ms
27ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.171&r=stable&domain=www.fortinet.com&hme=d82868061a8c707cd31395a3055e7449daa03bd520872727258c39e6af34523e&ex_m=70%2C120%2C106%2C110%2C61%2C4%2C99%2C69%2C16%2C96%2C88%2C51%2C54%2C171%2C174%2C186%2C182%2C183%2C185%2C29%2C100%2C53%2C77%2C184%2C166%2C169%2C179%2C180%2C187%2C130%2C41%2C34%2C142%2C15%2C50%2C193%2C192%2C132%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C92%2C17%2C14%2C95%2C91%2C90%2C107%2C52%2C109%2C39%2C108%2C30%2C93%2C26%2C167%2C170%2C139%2C85%2C56%2C83%2C33%2C73%2C0%2C94%2C32%2C28%2C82%2C87%2C47%2C46%2C86%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C101%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C103%2C102%2C104%2C97%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C89%2C81%2C44%2C35%2C84%2C2%2C36%2C63%2C42%2C105%2C45%2C79%2C68%2C111%2C60%2C59%2C31%2C98%2C58%2C55%2C49%2C78%2C72%2C24%2C112

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

Resource Hash

0d968e7c57781ed6db034f945eeb2dcd7144e11472d4cb03aaed614c1615e728

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=23, rtx=0, c=72, mss=1232, tbw=67437, tp=63, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: gl5QH5fqvr1JbfVeJNHFzGA8rh2qiCpFVEi354imZMOf0WQxuC/FSD7MvJt0zfTQ1Ny10iVG0iKHFcnRG39IOg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 13189
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
333 B 32ms
31ms XHR
text/plain 34.196.140.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=NZlTqtu9vowXrexrDZrWUA&is_js=true&landing_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&t=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&tip=K_O3chQ64xJCOYbCjN14Gpv1v0nZiyt87JTsZ7a_o_o&host=https%3A%2F%2Fwww.fortinet.com&sa_conv_data_css_value=%270-a2b16bcd-fd59-5f96-585f-b23182920362%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9a2b16bcdfd595f96585fb23182920362a772d167&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIPiNVVVjf4Tl9IQr6-i1WViXVQEozW0CRQSMhmC6a0aAENYBGAQgofC5uAYwAToEQN4Ii0IEfsQw3Q.iKurb%252FukDjUFXphAgboDlToV1K1Es%252FIjM04Z8L5QkbI&sa-user-id-v2=s%253AorFrzf1ZX5ZYX7IxgpIDYqdy0Wc.SPXDt9tHLKKGBgsRIME1P3Dp860tMQpLFWsgWKQRpmo&sa-user-id=s%253A0-a2b16bcd-fd59-5f96-585f-b23182920362.hgDOA52uEDsvLLS8wHBk1%252FnUUdvQbtnS6E0OP2Fmz54
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.140.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-140-205.compute-1.amazonaws.com
Software: /
Resource Hash: e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
content-length: 138
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 90ms
24ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&rl=&if=false&ts=1729001505790&sw=1600&sh=1200&v=2.9.171&r=stable&ec=0&o=4126&fbp=fb.1.1729001505775.26537696567437993&ler=empty&cdl=API_unavailable&it=1729001505691&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=22, rtx=0, c=10, mss=1297, tbw=2963, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 163ms
98ms Image
image/png 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&rl=&if=false&ts=1729001505790&sw=1600&sh=1200&v=2.9.171&r=stable&ec=0&o=4126&fbp=fb.1.1729001505775.26537696567437993&ler=empty&cdl=API_unavailable&it=1729001505691&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7426004919265486190"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xf77e856888256f1c","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"3":["1473595392721544"]},"debug_reporting":true,"debug_key":"1543075636330413103"}
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: X9Rzh9zbV7Up1QBpYbweQyh0yHqWnLh92f1bty1231XhjzUk86//05OMCffBOYmbb3/C1Z3aucxioc/6IwdjGA==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7426004919265486190", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=22, rtx=0, c=14, mss=1297, tbw=3281, tp=-1, tpl=-1, uplat=70, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H/1.1 200
OK https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa Show response
abm-tracking.demandscience.com/page-tracking/fortinet_2712/ 2 B
665 B 109ms
108ms Script
application/json 52.32.164.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://abm-tracking.demandscience.com/page-tracking/fortinet_2712/https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?visitorId=58d0314c08f435da2e1fccee497d419a_1729001505816&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Tue, 15 Oct 2024 14:11:45 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 200 tag.aspx Show response
ml314.com/ 38 KB
13 KB 75ms
17ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?159
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
content-encoding: br
age: 2255
x-goog-stored-content-encoding: identity
x-cache-hit: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39162
date: Tue, 15 Oct 2024 13:34:10 GMT
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
content-type: application/javascript
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY2MdN-cIh25jRr1wTH7GU1raEmLwEJDLpKisMKIK5yA2T3MrEXouF_hFdS43z28LLlqftA
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
cache-id: YUL
accept-ranges: bytes
x-goog-generation: 1721849450340665
content-length: 12522
server: UploadServer

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
199 B 110ms
108ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: E785E4C2B99349CF8B4A55C2DCB67895 Ref B: YMQ01EDGE0308 Ref C: 2024-10-15T14:11:45Z
x-li-fabric: prod-lor1
access-control-allow-credentials: true
x-li-uuid: AAYkhIiTDbX4zuN+H+gsgA==
x-li-proto: http/2
access-control-allow-origin: https://www.fortinet.com
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:45 GMT
vary: Origin

GET
H2 200 image.aspx
6033413.global.siteimproveanalytics.io/ 34 B
149 B 253ms
29ms Image
image/gif 3.94.188.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6033413.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&res=1600x1200&accountid=6033413&rt=4070&prev=01198bf6-22c0-d0c6-4366-edfe9a3e2c60&luid=7374721d-7d28-d1f0-32e1-cdd65137940e&rnd=81967
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.94.188.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-94-188-245.compute-1.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: Tue, 15 Oct 2024 14:11:46 UTC
cache-control: max-age=0
content-length: 34
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: image/gif

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 189 KB
68 KB 67ms
66ms Script
application/javascript 142.250.80.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4NSPPXN

Requested by

Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.104 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

6d80b8098eba75ad559b658c787e7702448efbc4175b16c87b075d4c92801337

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Tue, 15 Oct 2024 14:11:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 15 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 69232
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK tracking Show response
tracking.contanuity.com/ 2 B
769 B 279ms
94ms Script
application/json 54.203.236.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.contanuity.com/tracking?visitorId=58d0314c08f435da2e1fccee497d419a_1729001505816&&clientId=undefined&&cookieEnabled=true
Requested by: Host: abm-tracking.demandscience.com
URL: https://abm-tracking.demandscience.com/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.203.236.163 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-203-236-163.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Tue, 15 Oct 2024 14:11:46 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H2 200 utsync.ashx Show response
ml314.com/ 641 B
1 KB 67ms
65ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pv=1729001505937_qile48a66&bl=en-ca&cb=7485201&return=&ht=&d=&dc=&si=1729001505937_qile48a66&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?159
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2c52420545022e28f4d2e27ce26980bc9069f6d33f0b5a9386b44132d85e02d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Tue, 15 Oct 2024 14:11:45 GMT
content-type: application/javascript
server: Google Frontend

GET
H2 200 ibs:dpid=22052&dpuuid=3647725148076245074&redir=
dpm.demdex.net/ 42 B
716 B 46ms
40ms Image
image/gif 18.209.0.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3647725148076245074&redir=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.209.0.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-209-0-122.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v065-074befdb5.edge-va6.demdex.com 3 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: BBJS/GGMRsQ=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: image/gif

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3647725148076245074
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzY0NzcyNTE0ODA3NjI0NTA3NBAAGg0IovC5uAYSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=408c93b6987dc70f430f230c1d7d3dda9b18f0782b3137b8f9b45a758594f1e3f4cb09cee1a4f8eb&person_id=3647725148076245074&eid=50082

43 B
56 B

53ms
53ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=408c93b6987dc70f430f230c1d7d3dda9b18f0782b3137b8f9b45a758594f1e3f4cb09cee1a4f8eb&person_id=3647725148076245074&eid=50082
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Wed, 16 Oct 2024 14:11:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://ml314.com/csync.ashx?fp=408c93b6987dc70f430f230c1d7d3dda9b18f0782b3137b8f9b45a758594f1e3f4cb09cee1a4f8eb&person_id=3647725148076245074&eid=50082
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Tue, 15 Oct 2024 14:11:46 GMT

GET
H3

200

utsync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&gdpr=0&gdpr_consent=

43 B
61 B

59ms
59ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0,Wed, 16 Oct 2024 14:11:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

location: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&gdpr=0&gdpr_consent=
content-length: 241
date: Tue, 15 Oct 2024 14:11:46 GMT
server: Kestrel

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3647725148076245074%26eid=2
https://ml314.com/csync.ashx?fp=1300617778988373177&person_id=3647725148076245074&eid=2

43 B
56 B

59ms
57ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=1300617778988373177&person_id=3647725148076245074&eid=2
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

via: 1.1 google
expires: Wed, 16 Oct 2024 14:11:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-store, no-cache, private
location: https://ml314.com/csync.ashx?fp=1300617778988373177&person_id=3647725148076245074&eid=2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 167.114.209.103; 167.114.209.103; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: a681f9bb-0017-4aa0-9626-8c2f9be51105
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Tue, 15 Oct 2024 14:11:46 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=29pNpqh8U7IYTxJ6VUsI6pcUmzAgkddVkVDThh4SFILQ&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

70 B
440 B

31ms
30ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 15 Oct 2024 14:11:46 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
pragma: no-cache
via: 1.1 google
expires: 0,Wed, 16 Oct 2024 14:11:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
content-length: 43
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: image/gif
x-cloud-trace-context: 46f7c42b8b0e0ca7bccc7a0d5d802a4d
server: Google Frontend

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 38ms
35ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=df60f9aa-4604-4bba-8d54-9853b2caaf17&session=1142e5c5-b03f-4609-8500-7468ae68b9b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A45%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222022%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=3791cefb-2339-4629-8041-c3f35fb92078&ipv6=2607%3A5300%3A60%3A7867%3A%3A9&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:46 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET

usersync
tracking.contanuity.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=58d0314c08f435da2e1fccee497d419a_1729001505816
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=58d0314c08f435da2e1fccee497d419a_1729001505816&_bee_ppp=1
https://tracking.contanuity.com/usersync?bwcookie=AADCok7OHPAAABVbbK9ifg

0
0

GET
H2 401 / Show response
webtracker.argusplatform.com/wh/track/ 205 B
468 B 503ms
372ms XHR
application/json 2620:1ec:29:1::35
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1729001505764717722&event_type=page_request&timestamp=1729001506&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer=

Requested by

Host: tmp.argusplatform.com
URL: https://tmp.argusplatform.com/js/wid.tracker.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:29:1::35 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

request-context: appId=cid-v1:ead16ead-3a47-42dd-aec9-91a1bbb42ff5
strict-transport-security: max-age=31536000
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Tue, 15 Oct 2024 14:11:46 GMT
content-type: application/json; charset=utf-8
x-azure-ref: 20241015T141146Z-174b7fcd4f8hd47t9x83dhkacs000000052g0000000016gn

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 34ms
33ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=df60f9aa-4604-4bba-8d54-9853b2caaf17&session=1142e5c5-b03f-4609-8500-7468ae68b9b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A46%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%223026%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=3791cefb-2339-4629-8041-c3f35fb92078&ipv6=2607%3A5300%3A60%3A7867%3A%3A9&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 3 KB
2 KB 433ms
98ms Script
application/javascript 44.235.191.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1368671678.1729001504&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001504%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001505%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221368671678.1729001504%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729001504.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22h%2BaFGMNKdS1nIKxn6gJYutMWJdxbJJjP%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729001504.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001504%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001505%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=11119047117937764term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Requested by: Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=11119047117937764term=value
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 44.235.191.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-235-191-156.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 0abf984f8ea992b996ff70a29d7118ed3bc6d9fbd4da78472543a2073b6b11bb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 0
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Tue, 15 Oct 2024 14:11:47 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H/1.1 200
OK gs Show response
gs.mountain.com/ 144 B
733 B 416ms
98ms Script
application/javascript 35.81.162.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gs.mountain.com/gs
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1368671678.1729001504&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001504%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001505%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221368671678.1729001504%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729001504.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22h%2BaFGMNKdS1nIKxn6gJYutMWJdxbJJjP%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729001504.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001504%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001505%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=11119047117937764term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.81.162.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-81-162-201.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 7b19e4a861f761e7c35aab3074c4546dab8e0100a576d513598551a3fb67686c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 0
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Tue, 15 Oct 2024 14:11:48 GMT
content-length: 144
content-type: application/javascript;charset=utf-8
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 48ms
38ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=df60f9aa-4604-4bba-8d54-9853b2caaf17&session=1142e5c5-b03f-4609-8500-7468ae68b9b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A47%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%224030%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=3791cefb-2339-4629-8041-c3f35fb92078&ipv6=2607%3A5300%3A60%3A7867%3A%3A9&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:48 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H/1.1 200
OK st Show response
px.mountain.com/ 6 KB
2 KB 401ms
217ms Script
application/javascript 44.235.191.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1368671678.1729001504&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001504%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001505%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221368671678.1729001504%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729001504.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22h%2BaFGMNKdS1nIKxn6gJYutMWJdxbJJjP%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729001504.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001504%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001505%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue&cb=1729001507806700&shguid=f347680e-21f0-392f-a261-7dcbfdb0f417&shgts=1729001508225
Requested by: Host: px.mountain.com
URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1368671678.1729001504&shpt=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001504%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001505%22%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221368671678.1729001504%22%2C%22shpt%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221729001504.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22h%2BaFGMNKdS1nIKxn6gJYutMWJdxbJJjP%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1729001504.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221729001504%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3A%221729001505%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&cb=11119047117937764term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Cmediamath%3Dtrue%2Cappnexus%3Dtrue
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 44.235.191.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-235-191-156.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 2df1deb7b15929e2d9e346871900891703df59164845bfc8ac632be11ce93708

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 122
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Tue, 15 Oct 2024 14:11:48 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H/1.1

200
OK

tdsync
px.steelhousemedia.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=6a64d09a-8aff-11ef-b7dc-a197cc410e3f&gdpr=&gdpr_consent=
https://px.steelhousemedia.com/tdsync?tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&shguid=6a64d09a-8aff-11ef-b7dc-a197cc410e3f

0
320 B

713ms
429ms

Image
text/plain

44.225.29.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.steelhousemedia.com/tdsync?tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&shguid=6a64d09a-8aff-11ef-b7dc-a197cc410e3f
Protocol: HTTP/1.1
Server: 44.225.29.129 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-225-29-129.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 336
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Tue, 15 Oct 2024 14:11:49 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

Redirect headers

location: https://px.steelhousemedia.com/tdsync?tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&shguid=6a64d09a-8aff-11ef-b7dc-a197cc410e3f
content-length: 277
date: Tue, 15 Oct 2024 14:11:48 GMT
server: Kestrel

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3
https://dpm.demdex.net/ibs:dpid=903&dpuuid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YzViOTM1ZjYtYjBhOS00MzRkLWJiM2ItYzA2YWRlMWVkNWI1&gdpr=0&gdpr_consent=&ttd_tdid=c5b935f6-b0a9-434d-bb3b-c06ad...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&google_gid=CAESEEk2CL4Ncft1FytSd1WxnSI&google_cver=1
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=1300617778988373177&ttd_tdid=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1830&partner_device_id=c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3...
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D08936234-aa45-46e6-8571-aeb5ac0ba97b%252Chttps%2525...
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=1300617778988373177&pt=08936234-aa45-46e6-8571-aeb5ac0ba97b%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad

70 B
497 B

32ms
31ms

Image
image/gif

52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
Protocol: H2
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-length: 70
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Tue, 15 Oct 2024 14:11:49 GMT
server: Jetty(11.0.13)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 33ms
33ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=df60f9aa-4604-4bba-8d54-9853b2caaf17&session=1142e5c5-b03f-4609-8500-7468ae68b9b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A48%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225032%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=3791cefb-2339-4629-8041-c3f35fb92078&ipv6=2607%3A5300%3A60%3A7867%3A%3A9&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:49 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:49 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET img.gif
b.6sc.co/v1/beacon/ 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 34ms
33ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=df60f9aa-4604-4bba-8d54-9853b2caaf17&session=1142e5c5-b03f-4609-8500-7468ae68b9b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A51%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A50%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%227033%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=3791cefb-2339-4629-8041-c3f35fb92078&ipv6=2607%3A5300%3A60%3A7867%3A%3A9&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 15 Oct 2024 14:11:51 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 15 Oct 2024 14:11:51 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: i.simpli.fi
URL: https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp

Domain: ad.doubleclick.net
URL: https://ad.doubleclick.net/activity;register_conversion=1;src=10050195;npa=0;auiddc=572786102.1729001504;ps=1;pcor=1963096138;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a90v9185241837za200zb9123037237;gcd=13l3l3l3l1l1;dma=0;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa?

Domain: tracking.contanuity.com
URL: https://tracking.contanuity.com/usersync?bwcookie=AADCok7OHPAAABVbbK9ifg

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=df60f9aa-4604-4bba-8d54-9853b2caaf17&session=1142e5c5-b03f-4609-8500-7468ae68b9b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2015%20Oct%202024%2014%3A11%3A49%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226033%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20case%20where%20an%20advanced%20adversary%20was%20observed%20exploiting%20three%20vulnerabilities%20affecting%20the%20Ivanti%20Cloud%20Services%20Appliance%20(CSA).%20This%20incident%20is%20a%20prime%20example%20of%20how%20threat%20actors%20chain%20zero-day%20vulnerabilities%20to%20gain%20initial%20access%20to%20a%20victim%E2%80%99s%20network.%20Learn%20more.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2Czero-day%20vulnerability%22%2C%22title%22%3A%22Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&pageViewId=3791cefb-2339-4629-8041-c3f35fb92078&ipv6=2607%3A5300%3A60%3A7867%3A%3A9&v=1.1.29

Verdicts & Comments Add Verdict or Comment

166 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

85 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-21 09:02:21	Name: cookiesession1 Value: 678A3E594B3F6D43E916259CA31966B5
.fortinet.com/	1970-01-21 09:02:17	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Tue+Oct+15+2024+07%3A11%3A43+GMT-0700+(Pacific+Daylight+Time)&version=6.10.0&hosts=&consentId=8858c6d3-2f88-440d-b5fb-a077a54693de&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.fortinet.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-21 04:35:53	Name: demdex Value: 61365736992321897700592417269413966323
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
.simpli.fi/	1970-01-21 09:03:43	Name: suid Value: 24A2B3BF1FEF4FEFA918466739835E3A
.fortinet.com/	1970-01-21 00:16:43	Name: mboxEdgeCluster Value: 34
.fortinet.com/	1970-01-21 09:52:41	Name: mbox Value: session#8ce269d0a433440ba543363ccb4bf4b3#1729003365\|PC#8ce269d0a433440ba543363ccb4bf4b3.34_0#1792246305
.dpm.demdex.net/	1970-01-21 04:35:53	Name: dpm Value: 61365736992321897700592417269413966323
www.fortinet.com/	1970-01-21 09:52:41	Name: _gd_visitor Value: df60f9aa-4604-4bba-8d54-9853b2caaf17
www.fortinet.com/	1970-01-21 00:16:55	Name: _gd_session Value: 1142e5c5-b03f-4609-8500-7468ae68b9b7
.fortinet.com/	1970-01-21 09:52:41	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 179643557%7CMCIDTS%7C20012%7CMCMID%7C61742584658573016980630101830149066875%7CMCAAMLH-1729606303%7C7%7CMCAAMB-1729606303%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1729008703s%7CNONE%7CMCSYNCSOP%7C411-20019%7CvVersion%7C5.5.0
.fortinet.com/	1970-01-21 02:26:17	Name: _gcl_au Value: 1.1.572786102.1729001504
www.fortinet.com/	1970-01-21 00:16:41	Name: dicbo_id Value: %7B%22dicbo_fetch%22%3A1729001504378%7D
.fortinet.com/	1970-01-21 00:18:07	Name: _uetsid Value: 685a6a708aff11efaafba10a02499430
.fortinet.com/	1970-01-21 09:38:17	Name: _uetvid Value: 685cd4008aff11efb2d2152b88874101
.bing.com/	1970-01-21 09:38:17	Name: MUID Value: 024947467D7D6413397A525F7C466531
.bat.bing.com/	1970-01-21 00:26:46	Name: MR Value: 0
.fortinet.com/	1970-01-21 09:52:41	Name: _ga_38BQ9XFDT4 Value: GS1.1.1729001504.1.0.1729001504.0.0.0
.fortinet.com/	1970-01-21 09:52:41	Name: _ga Value: GA1.1.1368671678.1729001504
.fortinet.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.doubleclick.net/	1970-01-21 04:35:53	Name: receive-cookie-deprecation Value: 1
www.fortinet.com/	1970-01-21 09:52:41	Name: _omappvp Value: CYbNkC3uW1cfntwUlxohBNVmP7XREa4s0V7Ba1QRmpA0ccO7lGY1T0qkyGnTLJwy5bv8Ol2VPqyJsAiRCdSLmV4iDkJubD0l
www.fortinet.com/	1970-01-21 00:16:42	Name: _omappvs Value: 1729001504990
www.fortinet.com/	1970-01-21 00:26:46	Name: AWSALB Value: 1ghh77bTK8PMXu35Md0O6My7eOcEipmJ68zO+17M7n5xhX4wgweMNkqwl0wwV0S3oV7sN3va2fMY3Fy4zQt+2RWjWCp930E6NvFMACdwptq2e2rwpBs6/sGHjAmRL73Ejqrkgek5JrHqtNqqoQMq9umJbBEXPYNhGEzdR69JqwfbrEEaQ5JCUBwFOhGBoQyXAUbKpJK28GZu1u5G7AAI0jMFiGQF7aCu
www.fortinet.com/	1970-01-21 00:26:46	Name: AWSALBCORS Value: DSI56lRYSxrYC2JZuc6nhsEXb+SZ5BoVpOSz/7775DACn9dcbeJZlsnMonhIhLzfc7ccfzB6ZK+aNo/E6Wm50hUU/o4n3MM9Y6a/1HqHDOkTf/wTw98QSVBoFGRtg9Zr7dWMudeXmBnKwdLYepjJBS3jLGK+G1jOrIbch4VJaT7rPETZsrMiGpMUKAFyB0w89y7tCdFWyQngFcOOh30EEBzt3v6uaIKZ
.fortinet.com/	1970-01-21 00:16:43	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
.fortinet.com/	1970-01-21 02:26:17	Name: s_getNewRepeat Value: 1729001505215-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.techtarget.com/	1970-01-21 00:16:43	Name: __cf_bm Value: FMkfwU808VQOAUrZkYnikZDLBcCsjaLC9yTujqQWhYI-1729001505-1.0.1.1-.ppaCuSZmPGvGUulolUY3a25a9b4YXayCzKJFZoU71jngEqJynTorGzeRbAU3Y22UGW6T_e1fY2lyvGcoRKUpg
.fortinet.com/	1970-01-21 09:52:41	Name: _ga_JH142QCQCJ Value: GS1.1.1729001505.1.0.1729001505.0.0.0
.adnxs.com/	1970-01-21 09:52:41	Name: receive-cookie-deprecation Value: 1
.fortinet.com/	1970-01-21 00:18:07	Name: _ce.clock_data Value: 46%2C167.114.209.103%2C1%2Ccd70ceeb4a1768030b1882c90242a428%2CChrome%2CCA
.fortinet.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.fortinet.com/	1970-01-21 09:02:17	Name: _ce.s Value: v~20c39875955e367c05e741cc1d80b58c65fc1360~lcw~1729001505433~vir~new~lva~1729001504855~vpv~0~v11.cs~424000~v11.s~68fa9180-8aff-11ef-a6ca-23c70dd3468b~lcw~1729001505435
.www.fortinet.com/	1970-01-21 09:02:17	Name: WID_VISITOR_ID Value: 1729001505764717722
tags.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id Value: s%3A0-a2b16bcd-fd59-5f96-585f-b23182920362.hgDOA52uEDsvLLS8wHBk1%2FnUUdvQbtnS6E0OP2Fmz54
.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id Value: s%3A0-a2b16bcd-fd59-5f96-585f-b23182920362.hgDOA52uEDsvLLS8wHBk1%2FnUUdvQbtnS6E0OP2Fmz54
tags.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id-v2 Value: s%3AorFrzf1ZX5ZYX7IxgpIDYqdy0Wc.SPXDt9tHLKKGBgsRIME1P3Dp860tMQpLFWsgWKQRpmo
.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id-v2 Value: s%3AorFrzf1ZX5ZYX7IxgpIDYqdy0Wc.SPXDt9tHLKKGBgsRIME1P3Dp860tMQpLFWsgWKQRpmo
tags.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id-v3 Value: s%3AAQAKIPiNVVVjf4Tl9IQr6-i1WViXVQEozW0CRQSMhmC6a0aAENYBGAQgofC5uAYwAToEQN4Ii0IEfsQw3Q.iKurb%2FukDjUFXphAgboDlToV1K1Es%2FIjM04Z8L5QkbI
.srv.stackadapt.com/	1970-01-21 09:02:17	Name: sa-user-id-v3 Value: s%3AAQAKIPiNVVVjf4Tl9IQr6-i1WViXVQEozW0CRQSMhmC6a0aAENYBGAQgofC5uAYwAToEQN4Ii0IEfsQw3Q.iKurb%2FukDjUFXphAgboDlToV1K1Es%2FIjM04Z8L5QkbI
www.fortinet.com/	1970-01-21 09:02:17	Name: sa-user-id Value: s%253A0-a2b16bcd-fd59-5f96-585f-b23182920362.hgDOA52uEDsvLLS8wHBk1%252FnUUdvQbtnS6E0OP2Fmz54
www.fortinet.com/	1970-01-21 09:02:17	Name: sa-user-id-v2 Value: s%253AorFrzf1ZX5ZYX7IxgpIDYqdy0Wc.SPXDt9tHLKKGBgsRIME1P3Dp860tMQpLFWsgWKQRpmo
www.fortinet.com/	1970-01-21 09:02:17	Name: sa-user-id-v3 Value: s%253AAQAKIPiNVVVjf4Tl9IQr6-i1WViXVQEozW0CRQSMhmC6a0aAENYBGAQgofC5uAYwAToEQN4Ii0IEfsQw3Q.iKurb%252FukDjUFXphAgboDlToV1K1Es%252FIjM04Z8L5QkbI
.adnxs.com/	1970-01-21 02:26:17	Name: anj Value: dTM7k!M4/8CxrEQF']wIg2E?ed@5Ap!]tbP6j2F-XstGt!@E8=%1<jV
.adnxs.com/	1970-01-21 02:26:17	Name: XANDR_PANID Value: -aeI2VyL5br0dVH-uB4LbEC-LA6Hb3nj1Zi-tdrf4KKSqvnUpdCj7HX_mwrPm70NvnYTlQjIwDNknXNCmWFG20LM0fIDwAHu6oxWdEitX-M.
.adnxs.com/	1970-01-21 02:26:17	Name: uuid2 Value: 1300617778988373177
.twitter.com/	1970-01-21 09:52:41	Name: personalization_id Value: "v1_PAvVZRzrOd7gzkbmz1EUpw=="
.linkedin.com/	1970-01-21 09:02:17	Name: bcookie Value: "v=2&15cf011e-c6e8-410d-8284-2bfbd737d46b"
.linkedin.com/	1970-01-21 04:35:53	Name: li_gc Value: MTswOzE3MjkwMDE1MDU7MjswMjGS8ei0rZvxktH/sbFsDhSGO7gd/rVjKcB0xqGjGJIdxA==
.linkedin.com/	1970-01-21 00:18:07	Name: lidc Value: "b=OGST09:s=O:r=O:a=O:p=O:g=2954:u=1:x=1:i=1729001505:t=1729087905:v=2:sig=AQE3QSxlLLdAfWJtkSzxYsk7qNAX71uH"
.t.co/	1970-01-21 09:52:41	Name: muc_ads Value: 31c829ba-52b9-4a54-b871-72981a7287e7
.t.co/	1970-01-21 00:16:43	Name: __cf_bm Value: yG.vItwqQd1_TmmEb2LwiNKbwIMlCs_Q8FFX0NdI240-1729001505-1.0.1.1-gG31pJjZbMfpOsQBQRvNymroP9u7jQ4DZDx_3nfgVwQO0sMPlug3bPbGtZYB7XPxcyX80v9F0APmEN.vJRRLFg
.fortinet.com/	1970-01-21 02:26:17	Name: _fbp Value: fb.1.1729001505775.26537696567437993
.doubleclick.net/	1970-01-21 09:52:41	Name: IDE Value: AHWqTUnbrrca53x_VuZutWRFSF0MXAPFymuphbF1zWLRJLcM6fK_sCbTZzl9xYiH5As
www.fortinet.com/	1970-01-21 00:18:09	Name: aa_cc Value: CA
www.fortinet.com/	1970-01-21 00:18:09	Name: aa_cn Value: Canada
www.fortinet.com/	1970-01-21 00:18:09	Name: 6scexist Value: true
.fortinet.com/	1970-01-21 09:52:41	Name: nmstat Value: 01198bf6-22c0-d0c6-4366-edfe9a3e2c60
abm-tracking.demandscience.com/	1970-01-21 09:52:41	Name: userId Value: 58d0314c08f435da2e1fccee497d419a_1729001505816
.doubleclick.net/	1970-01-21 00:59:53	Name: ar_debug Value: 1
.ml314.com/	1970-01-21 09:02:17	Name: pi Value: 3647725148076245074
.ml314.com/	1970-01-21 00:36:51	Name: tp Value: 4%253B10%252F15%252F2024%2B14%253A11%253A45
.rlcdn.com/	1970-01-21 09:02:17	Name: rlas3 Value: ZAyfgObcP1W3Va+Ju6P7djsR0WRnAmfc4RmtVVrI+Yc=
.adsrvr.org/	1970-01-21 09:02:17	Name: TDID Value: c5b935f6-b0a9-434d-bb3b-c06ade1ed5b5
.eyeota.net/	1970-01-21 09:02:17	Name: mako_uid Value: 1929085456b-2e760000010a5814
.eyeota.net/	1970-01-21 00:16:42	Name: SERVERID Value: 22548~DM
tracking.contanuity.com/	1970-01-21 09:52:41	Name: userId Value: 58d0314c08f435da2e1fccee497d419a_1729001505816
tracking.contanuity.com/	1970-01-21 09:52:41	Name: clientId Value: undefined
.rlcdn.com/	1970-01-21 01:43:05	Name: pxrc Value: CKLwubgGEgUI6AcQABIFCNtOEAA=
.ml314.com/	1970-01-21 00:16:41	Name: u Value: aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLw%3D%3D
.bidr.io/	1970-01-21 09:45:15	Name: bito Value: AADCok7OHPAAABVbbK9ifg
.bidr.io/	1970-01-21 09:45:15	Name: bitoIsSecure Value: ok
.mountain.com/	1970-01-21 09:02:17	Name: guid Value: 6a64d09a-8aff-11ef-b7dc-a197cc410e3f
.px.mountain.com/	1970-01-21 09:02:17	Name: tt Value: "H4sIAAAAAAAAAKtW8guKNzYyNjaLNzK3NFayMtBRgnItjC2UrAzNjSwNDAxNDSxMDS10lMqUrIx0kLSA1RjUAgDYpbTrRgAAAA=="
.mountain.com/	1970-01-21 09:02:17	Name: rt Value: "MzIzMzY6MTcyOTAwMTUwOA=="
.rubiconproject.com/	1970-01-21 09:02:17	Name: audit_p Value: 1\|4rM8Ol+cdd7CVTgCgqvRtd/e9W3RmwyiyFNchHo7KX47wCFCn6f3ejK68FiydhdTApzlR07i36UwHTRO1/p4iHX0qfg68IpFQAPcN3ARK87+xxJM9l2ng1tjacfjkhsLhD9JQJ1icWZW2NVGSPLX5ICjJTs0hZZd5ZAjhZVzm3XREvsM2ra73MRmS8gGs6ylTlon0IrnE1p4+byUJuUHKNl4Am3SUH3rwETMVR8lnVPictVKI3nW/ZSmfFa9k+2RfCCm1vF3Tgn8ih/oL8+08tuVaVkDFDbShAUs62yL6R/QD5U7tEfUTQ==
.rubiconproject.com/	1970-01-21 09:02:17	Name: khaos Value: M2AIUUPW-15-CO0K
.rubiconproject.com/	1970-01-21 09:02:17	Name: khaos_p Value: M2AIUUPW-15-CO0K
.rubiconproject.com/	1970-01-21 09:02:17	Name: audit Value: 1\|4rM8Ol+cdd7CVTgCgqvRtd/e9W3RmwyiyFNchHo7KX47wCFCn6f3ejK68FiydhdTApzlR07i36UwHTRO1/p4iHX0qfg68IpFQAPcN3ARK87+xxJM9l2ng1tjacfjkhsLhD9JQJ1icWZW2NVGSPLX5ICjJTs0hZZd5ZAjhZVzm3XREvsM2ra73MRmS8gGs6ylTlon0IrnE1p4+byUJuUHKNl4Am3SUH3rwETMVR8lnVPictVKI3nW/ZSmfFa9k+2RfCCm1vF3Tgn8ih/oL8+08tuVaVkDFDbShAUs62yL6R/QD5U7tEfUTQ==
.tapad.com/	1970-01-21 01:43:05	Name: TapAd_TS Value: 1729001509637
.tapad.com/	1970-01-21 01:43:05	Name: TapAd_DID Value: 08936234-aa45-46e6-8571-aeb5ac0ba97b
.tapad.com/	1970-01-21 01:43:05	Name: TapAd_3WAY_SYNCS Value: 2!6950
.adsrvr.org/	1970-01-21 09:02:17	Name: TDCPM Value: CAESFgoHZDB0cm8xahILCP7x3N6qy7Y9EAUSEgoDYWFtEgsI2r-al_GYqz0QBRIVCgZnb29nbGUSCwig0rf5qsu2PRAFEhYKB3J1Ymljb24SCwiaibj5qsu2PRAFEhcKCGFwcG5leHVzEgsInKvl-6rLtj0QBRIUCgV0YXBhZBILCMTR5fuqy7Y9EAUYBTgBQgQiAggB

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1729001505764717722&event_type=page_request&timestamp=1729001505&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://webtracker.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1729001505764717722&event_type=page_request&timestamp=1729001506&page_title=Burning%20Zero%20Days%3A%20Suspected%20Nation-State%20Adversary%20Targets%20Ivanti%20CSA%20%7C%20FortiGuard%20Labs&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fburning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa&page_url_referer= Message: Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
6033413.global.siteimproveanalytics.io
a.omappapi.com
a.opmnstr.com
abm-tracking.demandscience.com
ad.doubleclick.net
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
b.6sc.co
bat.bing.com
c.6sc.co
cdn.cookielaw.org
cdn.jsdelivr.net
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
dpm.demdex.net
dx.mountain.com
eps.6sc.co
fortinet.demdex.net
fortinet.tt.omtrdc.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
i.simpli.fi
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
insight.adsrvr.org
intentstream.contanuity.com
ipv6.6sc.co
j.6sc.co
match.adsrvr.org
metrics.fortinet.com
ml314.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
pixels.argusplatform.com
ps.eyeota.net
px.ads.linkedin.com
px.mountain.com
px.steelhousemedia.com
px4.ads.linkedin.com
script.crazyegg.com
secure.adnxs.com
siteimproveanalytics.com
snap.licdn.com
static.ads-twitter.com
t.co
tag.simpli.fi
tags.inzynk.io
tags.srv.stackadapt.com
td.doubleclick.net
tmp.argusplatform.com
tr.outbrain.com
tracking.contanuity.com
tracking.crazyegg.com
trk.techtarget.com
wave.outbrain.com
webtracker.argusplatform.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
ad.doubleclick.net
b.6sc.co
i.simpli.fi
tracking.contanuity.com
104.19.148.8
104.244.42.195
13.107.42.14
142.250.64.68
142.250.64.99
142.250.65.230
142.250.80.104
142.251.40.226
142.251.40.98
146.75.28.157
157.240.241.1
172.217.165.134
172.66.0.227
172.67.163.237
18.209.0.122
18.209.125.30
18.214.54.215
2001:4860:4802:32::178
23.34.59.33
23.51.57.192
2600:141b:1c00:209a::1e80
2600:141b:1c00:2e::17d1:48c5
2600:141b:1c00:6::17df:d120
2600:1f18:1492:1702:852f:d87f:6683:b05a
2600:9000:2512:7400:12:dfa9:e200:93a1
2606:4700:3108::ac42:2af8
2606:4700:4400::6812:2089
2606:4700::6812:1247
2606:4700::6812:572a
2607:f8b0:4006:80c::2002
2607:f8b0:4006:80c::2008
2620:1ec:21::14
2620:1ec:29:1::35
2620:1ec:33:1::10
2a02:6ea0:c454::1
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42:200::485
3.135.83.200
3.94.188.245
34.111.113.62
34.111.208.231
34.117.77.79
34.196.140.205
34.235.33.249
34.86.70.109
35.244.154.8
35.81.162.201
44.225.29.129
44.226.187.177
44.235.191.156
52.22.50.55
52.223.40.198
52.32.164.86
52.7.151.245
54.203.236.163
63.140.39.65
63.140.39.93
64.202.112.191
68.67.160.137
68.67.161.208
69.173.151.100
74.121.140.211
75.2.108.141
03a0fcddc62f902b243bb6ed855041f4fa937340fd81d86552f672f24d6497da
0968bbb30f1aef951bb770793756fca4fd75cce26bce318ace9c6e31deddf7f6
09cb9d110b661c309dff74e762e8b279de370dd6b05218c3abc1142171bfb903
0abf984f8ea992b996ff70a29d7118ed3bc6d9fbd4da78472543a2073b6b11bb
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0d41c18875dbfc417ec3cdb20d698edd52b930504892fe1e3dd1c0f1ba9b42f7
0d87642c368aa398fe4dd35af439768fb2c9167ba52f2b995eaa3d61598853a6
0d968e7c57781ed6db034f945eeb2dcd7144e11472d4cb03aaed614c1615e728
0e6e31465592638aaa036384d85ebd6e6c56b9178591bceea4a0b815dd06d535
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
17095b0dfaded492b73f4f6a30412ecb2f7a87a2ebd1f8963d5c5cee3db937bd
17234dc33fee83a6097588da7dc802864fd9af021ff0b48fa73a404e30aa362c
18041a7dd2be9d4ba5469edca86d5bd763e3bdcae7a83c5559c618bf4be83f0f
188c1c4378ca30c9eef2b446a37c4a7eb75d043f56acf32c35eb0077bb8705a6
18e04370c6f2bee61d32771663e6b0408e1627bb89a3894457941fa19ad83000
18f5794db26670e34d8df06806be8536dc6520a380dcf67bced51fc8f7ef91e1
1a8491dacfaed6de53e20ff200c81255fb61def72f2696426a23ec5a05265b28
1aa2c530c01922a6c5b5b2f260995f54ad56fe3a991bf5a9bf59962a04950f4c
1bfc3fec636bdfc92ca324c43dc9382d5f1567b0cb29f806202c2ee530173b7e
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1d3e1ffd86a5653412775034689e08d77352a1a255038f3cf953b76318ac946a
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
26b37b2982358112ad578340484a7de6274a19db3fb6ea13f0b4e2d89e35f566
29d6b32f545f36a29ab83a4be5f92d4ebfb43a6dcc6457f7681a8478e5e8ea6c
2a880e90aa41697d0998bcebc3f454fbf9640deb91d3fb0da283e6b3f7ce3c66
2c52420545022e28f4d2e27ce26980bc9069f6d33f0b5a9386b44132d85e02d1
2df1deb7b15929e2d9e346871900891703df59164845bfc8ac632be11ce93708
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e50f9ae9324af2e1d1803215dfa3b1e4476f62bf1c3d548743835992ca87182
2e963b4b8f73348a8de67ca3f24258b1bfc6874339867af3119bd8751ad9db79
2ed114345dab0a74e1c81b100e3db108ff86464854f3159d005fac67413454b7
36186e198e296c76785020a85f35312fbf538fe48f96b8358b01c25cb5b673e8
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
388a2ece7b8df4f997005cfb977be0e088c4909bf5c41cec6b5c98f68f911e34
39a543197cee3bd0cac857a39467717e59781b5a8eec38ba40ebcc281e2c78b0
3ac2943bf8d9d7f8d3dfa505f1c382b028fa493ffb2e3e2145595815df4ee999
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
443f47f0ae01cec5b4bc117dffb451485e147a54865efa7c820320e68cb55909
450be4bf64305ebda12eebbbbdba85912e51497cbb52f921dab64a44310a16b1
47b269a1d6b45c240f78bdac74f774b82ebab14a5ae05a80da9174f333e7daac
4a42cb5f0ad29da9aee1a9f82f940d790c2b242ec4ae29bac91d7fb14990af6c
4aa70a752741f88840c0ae6612f71b6220ac77080c263caa1682cee47d9b39da
4af5dacf19bc195010075d202d98f083a444a8572cbc1711fe39225928cb6be1
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
4e9aa67ca1f1ffe2c11e722079a58f1be803c9378468d6c019be53b1ffd26c6b
55efcd9c7c8dc07e65a641a23760facd1b95fa530876ac2d2766e3247764ad3e
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5cde97a99252b4ad4fa0d3becd808a64e2b1946feef502515a47aab3f9110f7c
5f5f608153dad93ff75e36a1530e737c204320e4c67f5370335477fb22296bc9
5f7c381eca2f132069a8514789e46793cf6f5886b523ac91db7e33c41182248d
5fa043f0c7d87051071a76bfcd9a59a537991943ba96fde8cc718c5a0919b45b
608f95c0544308eaef8ee3554248e93e668f323fb954f584ddc12cd65947d251
61917dc4b13b887a30af978c934892e7db4329ba72bbd655635613b537d760e5
61af4356b1a56a808fbe79a6cd0f96444069b54d9eb1a1576b45c0e0f6bae0c5
629dea3fc8ca3364508e787cddbe7e6a1e0e72071d9ba2ba4539a2c60c8f1dea
62ccea4549c1c360f561987e20bd929c475a5f596bc7731a224d99e0d253cfa0
643a52fac3e3aae163ef76ad0a2a088d2f31ac2552eff000edc1b495c8fbba32
644e98e4c6ce7519f77dc6c7401426d231c8f895f550c7f6c514bb4ec302ec6a
661e67a6ed119b9a5bd08892caf68b0e794f68207156cd50f703d320ee6155ef
66a9e8a80c33a2f932441adf709f92aecca67782c8c0c5b1e165584d7eb3a291
67e31d0c68d13f39568b999b839a87be61a9b35a0d2d01212cbe5093edde095c
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552
6d80b8098eba75ad559b658c787e7702448efbc4175b16c87b075d4c92801337
701769ec99138974c12369fd4acf65a7f99e9a1becbab1e16a89be9859aafc9f
717f11c79608856a33546a50fe20ac984c44c933ba23ea02c851f8f0004df1fd
727d19bf895438013bb188825e546dd6e61f80c2a4ea8e7b6e978b96bab546f4
72a16e82ebbe48c45ef6e2a67f4645444081d0cb72e09324824fc123fc30f6a0
770c9baa68a917d800fb4cbae51eaaf337807ff7f93f6a018e952c13d90ea84c
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
7b19e4a861f761e7c35aab3074c4546dab8e0100a576d513598551a3fb67686c
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
7c37b5d2c568700acb5aa4d6fc9ece9bc0df8882dc473d944a854ade711a696c
80979b936a389e029f1d96f9b57e39257416add377d59a14c91708c48cc60ae2
872f233ef34c09bfa33644108af6f2dfce8f77a0e2dc0847882840355efc4820
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
8af6fb23ba1c0a4860476b240ba2d05c02ff018f1a93d2caadf7301ed87223d7
8c0aa54f351ccf9f614ac7519cec00ae1f40db7bbea8c7dd2fb51538a8d9b272
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8ef9e9b7103e38d4509a125612dad3ff98edfd671fa45f01d4d09c3cefa50a8f
90a224ae782e3be06cc08cd0dea598ea22f91ee4635920cc77228326bb5409d4
91aff3588efba0074124bbd204b45de0da882a853f29a1d73f7ec132291c5651
91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f
92cfae0b0d343d93e5e1d365bb9179904e50407d803588ec009e2bb19e211ea3
930494fef37c0c702073ceeddd12da067bba2824f8eba39e1f9a3c5332bec6b6
931a1bc91c7b780d9df916bdbd551447e2b0d742a0ff1bdd7a6dbb5f42619b39
933ddaeb7b389ab0803e3e7a1124cd51dcd097514e5e1cff4d4cef50b219779e
945064097c03c508a89cd8fd574bd597b4939675dda5bc76558c95be848f6030
94633716497a85d800b6e573953942c4cfe483c0dbd68fa97fd01dd97ced5d66
9636ce7f4b06bd40058b0417691448095e6490a3b518fbdeac3e104023fd9b92
96fa0a3199b1184d9aab3b1a117e7b88974daff72641aee7f50b44f80d404aa4
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d
9bcee3d09d7d09a58692fd63b04efbfa862832a4a5b89e360cf4ae0f556c66b5
9c2bfadf1fe546bd3872bf81e8477e95faff0104f3b9b888bc47cff4ffe88a36
9d475d9ddb409c9ce04da90006e5bf42b07adfa9e8acb3bf53a4d1de9f6736ae
a127f5d38a4a71d09b04fe89ab3c7cea05b5d20997a702855f66bcf3c0393cd5
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a23b68a0964626bb4062bf726dd4ab52d438dcfb88991402b224146d1087d1a7
a364f8998ea88f243a482109d256626e8d7cb72a05eac69ac608c27435241a65
a462bb85392ef235bc0ab080e8a9ae078a228fb74b3df156cb9f3ce7e20ad9e6
a4db214a51d8aa0b6a55aab329c983c0dba1976db88c499c75410392e220f9e5
a9a345b743fb7460be8d7e10ca085ea57901980b67d43151196d36f94a5451cb
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad15ab06d640d365a00d41e146660addb01348b2f6878f6ffdc1dc428c67cc19
afb08ef7dbe14e004ba0b93079e3c465c7c6f9d1038518826c8513126aa29ba7
b0b526b901a7afeac92efcd87a441305a26891bba8bfbb950f4b18f7fd582e59
b0c24ca8333c5e792fdbb0d0a02529e99999ae19484c6e304c4cc8ce4535d485
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15
b3f4fd3661f04c2c6374215073e85cb8c5c938ee783677f40e85151989c39d97
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
b697c4c8e7c22fa7e18ccef66c1bda6610f19ec8c7d1c60fb3696db54ea5362e
b69b5763c6c912b8a1852981c4401647963d63734e234b073d97c0dffbf64206
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bb13a80fdd4875e6626de9e2b4ebf7948f3cfe191f73b4dbf31e1247d0239667
bd6f701d7b3abd41679f87c496bc8911a602f247900dfc7ab7cb3a62abe098ee
beb07659642dc0e2fb0d2e7c13f71388ef3ceda13433e13a4e489d2c4826f506
bec3437c8baa45a6344648c2bb6806831972c5cdd7ae34a16897d6e205092476
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869
c153cd2dff5ec3af05397a2fe0f7dc1eb7544b5858521dca8bf1c20e439d70d4
c3be590171c0375d497714a608a5c4cd4e90e124e1c0cff1807cd8adb156e64b
c50c3a763973b8bc75e126c3f104f84a728f8febf50faa7e37685e86fa1e2c1b
c584b5d0f98a654a3857877fa1e3dbb85b0b0e779191ad952af4e14116205e2c
c622695ef459045b51c41af2aabcd78b04fa7f8a8e55267f7d3568fb230fe537
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86
c7e8cbd9d9f4e631663caf054f1744a59dd4e83e48c9c689ed055eb7e355bf59
ca71dd5e442ec07b69d4efd7eb32df28ba6465c47f4bf1ef2f9c4c941e29b386
cbe67b5b6fa27d2f9d4f18dba4f940ce8c4a3dbcab1541b5b1023ce4dcea66e0
cff43ffcd3d9feaba4fb1250d800a3b9650a7f65c26f00b196e403cc763ee1d4
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d3cdd8255b0cabf4568ec33c19f12ef6a3a761ea27bb36f0e1a12d9c4f31a2f5
d4edec0e6d150110e180ad38f47e5eab79358d5df97f12e15c73a4b538863451
d52a2d3a220f08a4d29008b71f2a760b08a891816e3f8a6e898c53b5c3ea5fca
d5dc4157271c9d3147055b0f2b85578271417af24cb1cfd197b84194ddaa0bfa
d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
db0da7efe3ac5fc9e598f71e291326f137ea7bbbf97fed4fee0e86b717b0d9a8
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e43a78cb528d99356d4426d8975072a19dbbbd71273d0d746f1287a2696d6853
e7a3eeb1ea3a3dde88a707fe6053d0074c8979df17db1bd6bbe8bae79377e6b7
e91d19121fbf6ef08ec7ce270a07ef60a36ee454268228a0d698f666c2d9f359
eae6da286f3f96b496b9b8f1e86c571f7e53f3ac5d4e1cd7a83ea8cf19af97e2
ec5a240780ab83205367dfb9274a408269d2a10d837164fe39eebabd757d9e7e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
eff032f2a7c04897a921492a9ce71e4fcbd047f1b2b487177955f000d6a182d6
f02faad1987312daa96dcd532794b6db4faa8a623306821b9d26235dbea36983
f21e3a5a80821feb91e7bb84d525742fd137c4b336f3ff3f1bb15dc2fcae9d70
f26ae51e214125767e456bc97f886b908749c984035ab7d7432fb11031a2a8e3
f46a9869eb1b18c3d0274a6ab46008bb2cfaa73cc3fbb25df8e2d6085ad706da
f53109bc9c1f5eba5a8e47a82b8a8e12de6fdd2c81f0a5320d5cd457708a5324
f797f871bec64d4d54308abab8c7008df6b855a83b59dbc17665e3c4111e7032
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fce461e0fefe1d6d687b3eab8304d3affaf23fb674b18bfb5242ccfc544e1bb7
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
feeeb4d4ea1cd6b99ca3730bdd88961f0ac2293455cd42e5977e7c41f9e209ba

www.fortinet.com Open in urlscan Pro 2600:1f18:1492:1702:852f:d87f:6683:b05a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

216 Requests

93 %HTTPS

29 %IPv6

45 Domains

69 Subdomains

59 IPs

2 Countries

6430 kBTransfer

10297 kBSize

85 Cookies

15 Outgoing links

Redirected requests

216 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1702:852f:d87f:6683:b05a Public Scan

Screenshot
Live screenshot

Full Image

216
Requests

93 %
HTTPS

29 %
IPv6

45
Domains

69
Subdomains

59
IPs

2
Countries

6430 kB
Transfer

10297 kB
Size

85
Cookies

216 HTTP transactions
3 data transactions