URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Submission: On December 08 via manual from US

Summary

This website contacted 50 IPs in 9 countries across 44 domains to perform 109 HTTP transactions. The main IP is 2606:4700:300b::a29f:f67d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.fireeye.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 3rd 2020. Valid for: a year.
This is the only time www.fireeye.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
22 2606:4700:300... 13335 (CLOUDFLAR...)
1 1 104.109.54.208 20940 (AKAMAI-ASN1)
2 13.108.250.7 14340 (SALESFORCE)
6 104.17.72.206 13335 (CLOUDFLAR...)
5 104.75.88.112 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 199.232.56.157 54113 (FASTLY)
1 216.58.212.130 15169 (GOOGLE)
1 2 216.58.210.6 15169 (GOOGLE)
2 2a03:2880:f01... 32934 (FACEBOOK)
2 104.109.95.62 20940 (AKAMAI-ASN1)
1 65.9.68.124 16509 (AMAZON-02)
1 2606:4700:303... 13335 (CLOUDFLAR...)
3 65.9.73.80 16509 (AMAZON-02)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 3 185.33.220.243 29990 (ASN-APPNEX)
1 65.9.68.84 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 65.9.73.13 16509 (AMAZON-02)
5 2a00:1450:400... 15169 (GOOGLE)
3 104.109.70.122 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a05:f500:10:... 14413 (LINKEDIN)
1 1 2620:1ec:21::14 8068 (MICROSOFT...)
1 104.244.42.5 13414 (TWITTER)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 65.9.68.74 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
8 54.84.216.236 14618 (AMAZON-AES)
1 209.197.3.15 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
1 3.229.202.186 14618 (AMAZON-AES)
2 18.195.61.105 16509 (AMAZON-02)
1 104.111.216.96 16625 (AKAMAI-AS)
1 104.244.42.3 13414 (TWITTER)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 183.79.219.124 24572 (YAHOO-JP-...)
1 192.28.147.68 15224 (OMNITURE)
2 23.20.13.199 14618 (AMAZON-AES)
4 54.224.123.127 14618 (AMAZON-AES)
1 13.110.64.53 14340 (SALESFORCE)
1 2 52.209.184.14 16509 (AMAZON-02)
1 183.79.255.28 24572 (YAHOO-JP-...)
2 2a00:1288:f03... 10310 (YAHOO-1)
1 54.75.9.158 16509 (AMAZON-02)
1 212.82.100.181 34010 (YAHOO-IRD)
109 50
Apex Domain
Subdomains
Transfer
28 fireeye.com
www.fireeye.com
www2.fireeye.com
679 KB
10 pathfactory.com
jukebox.pathfactory.com
spcollector.pathfactory.com
3 KB
6 google-analytics.com
www.google-analytics.com
19 KB
5 listenloop.com
v2.listenloop.com
abm2.listenloop.com
60 KB
4 doubleclick.net
8443343.fls.doubleclick.net
stats.g.doubleclick.net
googleads.g.doubleclick.net
2 KB
4 addthis.com
s7.addthis.com
m.addthis.com
191 KB
3 linkedin.com
px.ads.linkedin.com
www.linkedin.com
3 KB
3 6sc.co
j.6sc.co
c.6sc.co
b.6sc.co
8 KB
3 adnxs.com
secure.adnxs.com
3 KB
3 driftt.com
js.driftt.com
79 KB
3 salesforceliveagent.com
c.la2c2.salesforceliveagent.com
d.la2c2.salesforceliveagent.com
d.la1-c1-ia5.salesforceliveagent.com
42 KB
2 yimg.com
s.yimg.com
6 KB
2 bidr.io
segment.prod.bidr.io
1 KB
2 6sense.com
epsilon.6sense.com
540 B
2 facebook.com
www.facebook.com
246 B
2 google.de
www.google.de
637 B
2 google.com
www.google.com
637 B
2 marketo.net
munchkin.marketo.net
7 KB
2 facebook.net
connect.facebook.net
92 KB
2 bing.com
bat.bing.com
9 KB
2 licdn.com
snap.licdn.com
3 KB
2 maxmind.com
js.maxmind.com
2 KB
1 yahoo.com
sp.analytics.yahoo.com
933 B
1 omtrdc.net
fireeye.tt.omtrdc.net
946 B
1 yahoo.co.jp
b91.yahoo.co.jp
917 B
1 mktoresp.com
848-did-242.mktoresp.com
311 B
1 yimg.jp
s.yimg.jp
2 KB
1 cloudflare.com
cdnjs.cloudflare.com
24 KB
1 addthisedge.com
v1.addthisedge.com
1 KB
1 twitter.com
analytics.twitter.com
650 B
1 moatads.com
z.moatads.com
1 KB
1 driftqa.com
js.driftqa.com
21 KB
1 googleapis.com
fonts.googleapis.com
726 B
1 bootstrapcdn.com
maxcdn.bootstrapcdn.com
7 KB
1 lfeeder.com
tr.lfeeder.com
292 B
1 t.co
t.co
447 B
1 leadfeeder.com
lftracker.leadfeeder.com
5 KB
1 ml-api.io
attr.ml-api.io
485 B
1 ml-attr.com
s.ml-attr.com
276 B
1 lookbookhq.com
app.cdn.lookbookhq.com
174 KB
1 googleadservices.com
www.googleadservices.com
13 KB
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 googletagmanager.com
www.googletagmanager.com
94 KB
1 typography.com
cloud.typography.com
460 B
109 44
Domain Requested by
22 www.fireeye.com www.fireeye.com
8 jukebox.pathfactory.com www.fireeye.com
6 www.google-analytics.com www.googletagmanager.com
www.fireeye.com
6 www2.fireeye.com www.fireeye.com
www2.fireeye.com
4 abm2.listenloop.com www.fireeye.com
3 secure.adnxs.com 2 redirects www.fireeye.com
3 js.driftt.com www.fireeye.com
js.driftt.com
3 s7.addthis.com www.fireeye.com
s7.addthis.com
2 s.yimg.com www.fireeye.com
2 segment.prod.bidr.io 1 redirects www.fireeye.com
2 spcollector.pathfactory.com www.fireeye.com
2 epsilon.6sense.com www.fireeye.com
2 www.facebook.com www.fireeye.com
2 www.google.de www.fireeye.com
2 www.google.com www.fireeye.com
2 px.ads.linkedin.com 1 redirects www.fireeye.com
2 munchkin.marketo.net www.googletagmanager.com
munchkin.marketo.net
2 connect.facebook.net www.fireeye.com
connect.facebook.net
2 8443343.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 bat.bing.com www.googletagmanager.com
www.fireeye.com
2 snap.licdn.com www.googletagmanager.com
snap.licdn.com
2 js.maxmind.com www.fireeye.com
1 sp.analytics.yahoo.com www.fireeye.com
1 fireeye.tt.omtrdc.net www.fireeye.com
1 b91.yahoo.co.jp www.fireeye.com
1 d.la1-c1-ia5.salesforceliveagent.com www.fireeye.com
1 848-did-242.mktoresp.com www.fireeye.com
1 s.yimg.jp www.googletagmanager.com
1 cdnjs.cloudflare.com www.fireeye.com
1 m.addthis.com s7.addthis.com
1 v1.addthisedge.com s7.addthis.com
1 d.la2c2.salesforceliveagent.com www.fireeye.com
1 analytics.twitter.com www.fireeye.com
1 z.moatads.com s7.addthis.com
1 b.6sc.co www.fireeye.com
1 js.driftqa.com www.fireeye.com
1 c.6sc.co www.fireeye.com
1 fonts.googleapis.com www.fireeye.com
1 maxcdn.bootstrapcdn.com www.fireeye.com
1 googleads.g.doubleclick.net www.fireeye.com
1 tr.lfeeder.com www.fireeye.com
1 t.co www.fireeye.com
1 www.linkedin.com 1 redirects
1 stats.g.doubleclick.net www.fireeye.com
1 j.6sc.co www.fireeye.com
1 lftracker.leadfeeder.com www.fireeye.com
1 attr.ml-api.io www.fireeye.com
1 s.ml-attr.com 1 redirects
1 v2.listenloop.com www.fireeye.com
1 app.cdn.lookbookhq.com www.fireeye.com
1 www.googleadservices.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 www.googletagmanager.com www.fireeye.com
1 c.la2c2.salesforceliveagent.com www.fireeye.com
1 cloud.typography.com 1 redirects
109 55
Subject Issuer Validity Valid
fireeye.com
Cloudflare Inc ECC CA-3
2020-12-03 -
2021-12-03
a year crt.sh
la1-c2-ord.salesforceliveagent.com
DigiCert SHA2 Secure Server CA
2020-07-09 -
2021-07-06
a year crt.sh
www2.fireeye.com
Cloudflare Inc ECC CA-3
2020-07-05 -
2021-07-05
a year crt.sh
odc-prod-01.oracle.com
DigiCert Secure Site ECC CA-1
2020-07-22 -
2021-10-13
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
*.maxmind.com
Sectigo RSA Organization Validation Secure Server CA
2020-10-07 -
2021-11-06
a year crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA
2019-04-01 -
2021-05-07
2 years crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2020-10-27 -
2021-04-27
6 months crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2020-08-14 -
2021-08-19
a year crt.sh
www.googleadservices.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
*.doubleclick.net
GTS CA 1O1
2020-11-10 -
2021-02-02
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2020-11-02 -
2021-01-30
3 months crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2020-03-14 -
2021-04-13
a year crt.sh
cdn.lookbookhq.com
Amazon
2020-11-08 -
2021-12-07
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-08-05 -
2021-08-05
a year crt.sh
drift.com
Amazon
2020-09-21 -
2021-10-23
a year crt.sh
*.ml-api.io
Amazon
2020-02-06 -
2021-03-06
a year crt.sh
*.google.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
*.leadfeeder.com
Amazon
2020-03-13 -
2021-04-13
a year crt.sh
*.6sc.co
DigiCert SHA2 Secure Server CA
2020-01-07 -
2021-04-07
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA
2020-08-05 -
2021-02-05
6 months crt.sh
t.co
DigiCert SHA2 High Assurance Server CA
2020-03-05 -
2021-03-02
a year crt.sh
www.google.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
www.google.de
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
*.lfeeder.com
Amazon
2020-09-04 -
2021-10-06
a year crt.sh
*.google.de
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA
2020-09-22 -
2021-10-12
a year crt.sh
upload.video.google.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
*.pathfactory.com
Amazon
2020-04-05 -
2021-05-05
a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
driftqa.com
Amazon
2020-06-18 -
2021-07-18
a year crt.sh
*.6sense.com
Amazon
2020-07-29 -
2021-08-28
a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA
2020-01-17 -
2021-03-17
a year crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA
2020-03-05 -
2021-03-02
a year crt.sh
edge01.yahoo.co.jp
Cybertrust Japan SureServer CA G4
2020-10-08 -
2021-11-07
a year crt.sh
*.mktoresp.com
DigiCert SHA2 Secure Server CA
2020-01-17 -
2022-01-21
2 years crt.sh
*.listenloop.com
RapidSSL RSA CA 2018
2019-06-14 -
2021-06-17
2 years crt.sh
la1-c1-ia5.salesforceliveagent.com
DigiCert SHA2 Secure Server CA
2019-05-14 -
2021-05-13
2 years crt.sh
*.segment.prod.bidr.io
Amazon
2020-03-26 -
2021-04-26
a year crt.sh
mscedge01.yahoo.co.jp
Cybertrust Japan SureServer CA G4
2020-08-04 -
2021-09-03
a year crt.sh
*.yahoo.com
DigiCert SHA2 High Assurance Server CA
2020-11-15 -
2020-12-29
a month crt.sh
*.tt.omtrdc.net
DigiCert SHA2 Secure Server CA
2020-11-02 -
2021-11-09
a year crt.sh
*.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA
2020-08-01 -
2021-01-28
6 months crt.sh

This page contains 7 frames:

Primary Page: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Frame ID: D66854F0E02C9033913FA488D411073B
Requests: 105 HTTP requests in this frame

Frame: https://8443343.fls.doubleclick.net/activityi;dc_pre=CNTsh-asv-0CFdG8dwodSQoHbg;src=8443343;type=sitew0;cat=firee0;ord=6946157798335;gtm=2wgbu0;auiddc=1571942375.1607463665;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2;u2=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Frame ID: 68AF2E7367EC0E8257C2B4B4E55F952C
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 9F80B5E0E8AA26934A49B0DAC726912B
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 7D568C0083D1AD53CFCEC2F490845325
Requests: 1 HTTP requests in this frame

Frame: https://www2.fireeye.com/index.php/form/XDFrame
Frame ID: A3794A703AA90A30A109127F78FDF8E2
Requests: 2 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=3d2f4d98-182e-47d0-a40e-886dab0d6afd&sessionStarted=1607463669&campaignRefreshToken=ab7a4041-53b7-4dff-b8a4-833881f6ea4c&pageLoadStartTime=1607463665117
Frame ID: DB09B52E8959A461C99A0A16F38A16CA
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat
Frame ID: FEFD0FEF57E3E513DB420E5BDD9E1E6A
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

109
Requests

99 %
HTTPS

38 %
IPv6

44
Domains

55
Subdomains

50
IPs

9
Countries

1658 kB
Transfer

4530 kB
Size

33
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://cloud.typography.com/6746836/6977592/css/fonts.css HTTP 302
  • https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css
Request Chain 26
  • https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=6946157798335;gtm=2wgbu0;auiddc=1571942375.1607463665;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2;u2=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2 HTTP 302
  • https://8443343.fls.doubleclick.net/activityi;dc_pre=CNTsh-asv-0CFdG8dwodSQoHbg;src=8443343;type=sitew0;cat=firee0;ord=6946157798335;gtm=2wgbu0;auiddc=1571942375.1607463665;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2;u2=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Request Chain 32
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=fireeye.com&pId=8935603327613753185
Request Chain 43
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1607463665356&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2%3Dundefined HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26time%3D1607463665356%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fthreat-research%252F2020%252F12%252Funauthorized-access-of-fireeye-red-team-tools.html%253F2%253Dundefined%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1607463665356&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2%3Dundefined&liSync=true
Request Chain 105
  • https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value= HTTP 303
  • https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

109 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request unauthorized-access-of-fireeye-red-team-tools.html
www.fireeye.com/blog/threat-research/2020/12/
70 KB
18 KB
Document
General
Full URL
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14893102c4a2a0ddb9fc1f9d19e60e85be0390e875ea05c50be395cc8d44bdd1
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.fireeye.com
:scheme
https
:path
/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
content-type
text/html;charset=utf-8
set-cookie
__cfduid=d0ac956d83f72caedfc0960796524c4b31607463664; expires=Thu, 07-Jan-21 21:41:04 GMT; path=/; domain=.fireeye.com; HttpOnly; SameSite=Lax; Secure
cf-ray
5fe9a5fceab6d6ed-FRA
cache-control
public, max-age=691200
expires
Wed, 16 Dec 2020 21:41:05 GMT
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding,User-Agent
cf-cache-status
MISS
cf-request-id
06e5e612110000d6edc81f8000000001
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-content-type-options
nosniff nosniff
x-dispatcher
dispatcher2uswest1
x-frame-options
ALLOW-FROM https://content.fireeye.com
x-vhost
publish
x-xss-protection
1; mode=block
server
cloudflare
content-encoding
gzip
jquery.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/
111 KB
38 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
14853
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
38305
cf-request-id
06e5e615e90000d6edb9bbe000000001
last-modified
Mon, 07 Dec 2020 21:30:26 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"1baa2-5b5e688dbc763-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f31d6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
csrf.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/
4 KB
2 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
14831
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1676
cf-request-id
06e5e615e90000d6edf61f6000000001
last-modified
Mon, 07 Dec 2020 21:30:26 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"f3e-5b5e688db243c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f34d6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
clientlibs_nav.min.js
www.fireeye.com/etc/designs/fireeye-www/
12 KB
4 KB
Script
General
Full URL
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_nav.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
13782
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
3882
cf-request-id
06e5e615ea0000d6edc8248000000001
last-modified
Mon, 07 Dec 2020 21:33:43 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"2f77-5b5e694992a3e-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f35d6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
3982EDB9831683D51.css
www.fireeye.com/content/dam/fireeye-www/fw/f/775489/
Redirect Chain
  • https://cloud.typography.com/6746836/6977592/css/fonts.css
  • https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css
293 KB
219 KB
Stylesheet
General
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
11130
cf-polished
origSize=301416
x-vhost
publish
cf-bgj
minify
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
last-modified
Tue, 08 Dec 2020 18:35:35 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
W/"49968-5b5f8355f27e3-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id
06e5e616670000d6edc8253000000001
cf-ray
5fe9a603d8ddd6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT

Redirect headers

Date
Tue, 08 Dec 2020 21:41:05 GMT
Last-Modified
Wed, 01 Apr 2020 20:12:09 GMT
Server
AkamaiNetStorage
ETag
"d0795af83d79e23ccaffb60b4a75e364:1585771928"
Content-Type
text/html
Location
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css
Cache-Control
must-revalidate, private
Connection
keep-alive
X-HCo-pid
14
Content-Length
154
Expires
Tue, 08 December 2020 21:41:05 GMT
patch.css
www.fireeye.com/content/dam/fireeye-www/fw/css/
543 B
414 B
Stylesheet
General
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/css/patch.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f08cea88c54a644c35abf8c3b33f3d997ff5bd673b940936f82bb80fcb37b6e2
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
14831
cf-polished
origSize=827
x-vhost
publish
cf-bgj
minify
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
last-modified
Mon, 07 Dec 2020 21:32:34 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
W/"33b-5b5e69079737d-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id
06e5e615e70000d6edaeab4000000001
cf-ray
5fe9a6030f2bd6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
clientlibs_fw-2019.min.css
www.fireeye.com/etc/designs/fireeye-www/
210 KB
41 KB
Stylesheet
General
Full URL
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
82e4da2f6b37cb149745e150c5a68ef8535de0ce33704ea2c002c159b4760fe9
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
14830
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
41282
cf-request-id
06e5e615e80000d6edf2b35000000001
last-modified
Mon, 07 Dec 2020 21:30:26 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"34722-5b5e688db4a63-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f2cd6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
clientlibs_base.min.css
www.fireeye.com/etc/clientlibs/fireeye-blog/
5 KB
2 KB
Stylesheet
General
Full URL
https://www.fireeye.com/etc/clientlibs/fireeye-blog/clientlibs_base.min.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
11494
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1501
cf-request-id
06e5e615eb0000d6edaa277000000001
last-modified
Tue, 08 Dec 2020 18:29:31 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
W/"1507-5b5f81fad3ccb-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f30d6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
utils.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/
10 KB
4 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
14830
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
3706
cf-request-id
06e5e615eb0000d6ed9ea34000000001
last-modified
Mon, 07 Dec 2020 21:32:34 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"26ad-5b5e6907b4add-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f38d6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
granite.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/
4 KB
2 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
14830
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1702
cf-request-id
06e5e615eb0000d6ede337c000000001
last-modified
Mon, 07 Dec 2020 21:30:26 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"f90-5b5e688db179b-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f3ad6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
jquery.min.js
www.fireeye.com/etc.clientlibs/foundation/clientlibs/
16 B
151 B
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/jquery.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
14830
x-vhost
publish
vary
User-Agent, Accept-Encoding
content-length
16
cf-request-id
06e5e615eb0000d6eda287d000000001
last-modified
Mon, 07 Dec 2020 21:30:26 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"10-5b5e688db5ed4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f3cd6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
shared.min.js
www.fireeye.com/etc.clientlibs/foundation/clientlibs/
24 KB
7 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/shared.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
14830
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
6920
cf-request-id
06e5e615ec0000d6ed850cc000000001
last-modified
Mon, 07 Dec 2020 21:30:26 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"5e7e-5b5e688db4764-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f3ed6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
modern.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/
34 KB
12 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/modern.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
14829
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
11784
cf-request-id
06e5e615ec0000d6edcdb83000000001
last-modified
Mon, 07 Dec 2020 21:34:22 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"87c8-5b5e696ed7efc-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f3fd6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
kernel.min.js
www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/
119 KB
26 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/kernel.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
14829
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
26194
cf-request-id
06e5e615ec0000d6eda49ba000000001
last-modified
Mon, 07 Dec 2020 21:30:26 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"1dd96-5b5e688db2054-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6030f43d6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
deployment.js
c.la2c2.salesforceliveagent.com/content/g/js/34.0/
40 KB
41 KB
Script
General
Full URL
https://c.la2c2.salesforceliveagent.com/content/g/js/34.0/deployment.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.108.250.7 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl5-ord.la1-c2-ord.salesforceliveagent.com
Software
Jetty(9.4.z-SNAPSHOT) /
Resource Hash
3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:05 GMT
Cache-Control
max-age=60, must-revalidate
Last-Modified
Fri, 13 Nov 2020 17:40:02 GMT
Server
Jetty(9.4.z-SNAPSHOT)
Accept-Ranges
bytes
Content-Length
41338
Content-Type
application/javascript
fe-logo-color.svg
www.fireeye.com/content/dam/fireeye-www/fw/images/
3 KB
1 KB
Image
General
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/images/fe-logo-color.svg
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
13379
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1239
cf-request-id
06e5e6161a0000d6edfe098000000001
last-modified
Mon, 07 Dec 2020 21:32:08 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"cec-5b5e68ee85f51-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/svg+xml
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6035fd0d6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
bnr-mandiant-advantage-v2-315x315.png
www.fireeye.com/content/dam/fireeye-www/services/images/
55 KB
56 KB
Image
General
Full URL
https://www.fireeye.com/content/dam/fireeye-www/services/images/bnr-mandiant-advantage-v2-315x315.png
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2177a596b2b041d9073df78d98d34e96b5a17c82ae3035bff89ddb890a0d06b2
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
14230
cf-polished
origSize=57662
x-vhost
publish
cf-bgj
imgq:85,h2pri
vary
Accept-Encoding
content-length
56773
x-xss-protection
1; mode=block
last-modified
Mon, 07 Dec 2020 21:33:37 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"e13e-5b5e6943bdbf2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/png
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id
06e5e6161a0000d6eddb01f000000001
accept-ranges
bytes
cf-ray
5fe9a6035fd3d6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
forms2.min.js
www2.fireeye.com/js/forms2/js/
205 KB
68 KB
Script
General
Full URL
https://www2.fireeye.com/js/forms2/js/forms2.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dde2a7cd4331f78a4b35dca9aa2e716fc3d0c83ba0f855f0812cbfae4a27a805
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Mon, 12 Oct 2020 17:13:35 GMT
server
cloudflare
age
3121
etag
"4a0b51-33245-5b17c6b21edc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
5fe9a603fde51e6d-AMS
cf-request-id
06e5e6167f00001e6d9837e000000001
expires
Wed, 09 Dec 2020 01:41:05 GMT
clientlibs_fw.min.js
www.fireeye.com/etc/designs/fireeye-www/
164 KB
50 KB
Script
General
Full URL
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3f5dba2736798b2245d9497cc07995d3381b7b6f19dd3306a6e6075162105b8
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
14828
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
50673
cf-request-id
06e5e6161d0000d6edf8923000000001
last-modified
Mon, 07 Dec 2020 21:34:41 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"291cf-5b5e6980cebab-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a6035fced6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
addthis_widget.js
s7.addthis.com/js/300/
353 KB
114 KB
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Tue, 08 Dec 2020 21:41:05 GMT
x-host
s7.addthis.com
content-length
116325
gtm.js
www.googletagmanager.com/
315 KB
94 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
58935760b2de8b3b6f698c14a28e3f86f69fc28764d2c02217facf7c4503f1e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
96593
x-xss-protection
0
last-modified
Tue, 08 Dec 2020 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 08 Dec 2020 21:41:05 GMT
token.json
www.fireeye.com/libs/granite/csrf/
2 B
167 B
XHR
General
Full URL
https://www.fireeye.com/libs/granite/csrf/token.json
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
x-content-type-options
nosniff, nosniff
cf-cache-status
DYNAMIC
x-vhost
publish
vary
User-Agent, Accept-Encoding
content-length
2
cf-request-id
06e5e616110000d6edf9056000000001
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/json;charset=iso-8859-1
x-xss-protection
1; mode=block
cache-control
no-cache
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray
5fe9a6034fa9d6ed-FRA
expires
-1
me
js.maxmind.com/geoip/v2.1/country/
771 B
1 KB
XHR
General
Full URL
https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:252f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab48f62299666780204b364453d95ac88ce57d2b811cab859d5dd05a35c5527a

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin
*
cf-ray
5fe9a6038fc8c27c-FRA
content-length
771
cf-request-id
06e5e616310000c27cf48a0000000001
insight.min.js
snap.licdn.com/li.lms-analytics/
965 B
761 B
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:05 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Sep 2020 22:01:48 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=33644
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
448
bat.js
bat.bing.com/
27 KB
8 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4dd6c09ddcb0e53a6290cc1df35224856073ba5f89d4134bd7c69e4fd9c6f515

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:04 GMT
content-encoding
gzip
last-modified
Tue, 20 Oct 2020 22:19:32 GMT
x-msedge-ref
Ref A: 3D86226C49AB4C3F91BA7360B67E7AAE Ref B: FRAEDGE1413 Ref C: 2020-12-08T21:41:05Z
etag
"0b27f152fa7d61:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
8454
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.56.157 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
via
1.1 varnish
last-modified
Fri, 04 Dec 2020 00:21:46 GMT
age
64201
etag
"cbc512946c8abb461c6215ed5b454e5f+gzip"
vary
Accept-Encoding,Host
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding
gzip
cache-control
no-cache
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
1957
x-timer
S1607463665.296987,VS0,VE0
x-served-by
cache-lon4276-LON
conversion_async.js
www.googleadservices.com/pagead/
30 KB
13 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
5fb46ad88af0181f8aa600691dadedc2d6dd1946603b69bc36385f68efdd01a3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
12174
x-xss-protection
0
server
cafe
etag
1959326039972715456
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 08 Dec 2020 21:41:05 GMT
activityi;dc_pre=CNTsh-asv-0CFdG8dwodSQoHbg;src=8443343;type=sitew0;cat=firee0;ord=6946157798335;gtm=2wgbu0;auiddc=1571942375.1607463665;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F...
8443343.fls.doubleclick.net/ Frame 68AF
Redirect Chain
  • https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=6946157798335;gtm=2wgbu0;auiddc=1571942375.1607463665;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%...
  • https://8443343.fls.doubleclick.net/activityi;dc_pre=CNTsh-asv-0CFdG8dwodSQoHbg;src=8443343;type=sitew0;cat=firee0;ord=6946157798335;gtm=2wgbu0;auiddc=1571942375.1607463665;u1=https%3A%2F%2Fwww.fir...
0
0
Document
General
Full URL
https://8443343.fls.doubleclick.net/activityi;dc_pre=CNTsh-asv-0CFdG8dwodSQoHbg;src=8443343;type=sitew0;cat=firee0;ord=6946157798335;gtm=2wgbu0;auiddc=1571942375.1607463665;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2;u2=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
216.58.210.6 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s07-in-f6.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
8443343.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CNTsh-asv-0CFdG8dwodSQoHbg;src=8443343;type=sitew0;cat=firee0;ord=6946157798335;gtm=2wgbu0;auiddc=1571942375.1607463665;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2;u2=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Tue, 08 Dec 2020 21:41:05 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
484
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Tue, 08-Dec-2020 21:56:05 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Tue, 08 Dec 2020 21:41:05 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://8443343.fls.doubleclick.net/activityi;dc_pre=CNTsh-asv-0CFdG8dwodSQoHbg;src=8443343;type=sitew0;cat=firee0;ord=6946157798335;gtm=2wgbu0;auiddc=1571942375.1607463665;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2;u2=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
fbevents.js
connect.facebook.net/en_US/
89 KB
23 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0e49c2b4e86d3fda1dda93eb1210a47712f7b091181b4e7c6da2b3e6f8e86396
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
23320
x-xss-protection
0
pragma
public
x-fb-debug
QFVogcUI8yyQHA1zmnZkJ3KKH0BS7tC4yAGlqnaZ77FBQGe20ouivlvtFbUEzK6hVTXDnFYVWhJYi6VH4FEzAQ==
x-fb-trip-id
603378373
x-frame-options
DENY
date
Tue, 08 Dec 2020 21:41:05 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-95-62.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:05 GMT
Content-Encoding
gzip
Last-Modified
Wed, 05 Aug 2020 03:11:00 GMT
Server
AkamaiNetStorage
ETag
"a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
752
jukebox.js
app.cdn.lookbookhq.com/production/jukebox/current/
627 KB
174 KB
Script
General
Full URL
https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.68.124 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
af791735e8981444685cb725a0d68f447d27e58cd2a3aaac06d36edd1ffe661b

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 18:28:23 GMT
content-encoding
gzip
last-modified
Wed, 25 Nov 2020 01:59:36 GMT
server
AmazonS3
age
11563
etag
W/"2c5a57a7227f09a8f5b97c1cdde9fcb8"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
null
via
1.1 673c96d1f19de21216629aa48d90ac92.cloudfront.net (CloudFront)
cache-control
max-age=43200
x-amz-cf-pop
FRA56-C1
content-type
text/javascript
x-amz-cf-id
7fcssis6dTwNd2n0Mklo8YeYrZQbyHNIdpvfqBEmD_A7caLTVqSsdQ==
loop.bundle.js
v2.listenloop.com/
175 KB
57 KB
Script
General
Full URL
https://v2.listenloop.com/loop.bundle.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:dfcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f731a19e7f12a4854f3a3133b7bbf3cf80856d842f7aefd9b7545b0595aa149

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1612
x-amz-request-id
27A471FB289EA65C
x-amz-id-2
nsgfnCCBTkhR/9UjMazAFm4SDBfttF4Z67mJcZ6wtk9k4WfvOlMiNXnhoJht9yzvdHIW3CFqq1w=
last-modified
Tue, 08 Dec 2020 15:13:38 GMT
server
cloudflare
etag
W/"e9e30c4c92602575bbe7cb08d6c326cd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cD545BNKkpIYBKs6r4E2BmmACUVUT0EAu9wTCJ1z1OlpIxv2fS08YoU%2BKpapEs%2BTdYAAwJ%2FjugXhFiZVHzEGqgNhAQRkWXzQ5TVOPf0%2FLgTwLA4fOC3k6i1lq6vSHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=1800
cf-request-id
06e5e6180a00000530dbb5c000000001
cf-ray
5fe9a6067d210530-LAX
wm3vc3smix6y.js
js.driftt.com/include/1607463900000/
278 KB
79 KB
Script
General
Full URL
https://js.driftt.com/include/1607463900000/wm3vc3smix6y.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
32707266dd68e7dd9d370a689c30ccc96361d30688dd37a22ddc578d9a930b95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
LtKHg9XO36lliuNaAfTm6pLnrBtjj5be
content-encoding
gzip
etag
"1f246e4cd06d91094433cbd64a8118c0"
x-amz-cf-pop
AMS1-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 08 Dec 2020 20:08:55 GMT
server
nginx
date
Tue, 08 Dec 2020 21:41:05 GMT
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 4d43f2ff38c53dabf47263f1495ad9c0.cloudfront.net (CloudFront)
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
7PsnzoJsUhD1gloy6P2XTos0dj7k-IvNmBXPM6Wwfdb7QdDj2US1Vg==
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=fireeye.com&pId=8935603327613753185
4 B
485 B
Image
General
Full URL
https://attr.ml-api.io/?domain=fireeye.com&pId=8935603327613753185
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.68.84 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:06 GMT
Via
1.1 6def1f0ddc805dce17407cce01d5b32d.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA56-C1
x-amzn-RequestId
69b60f53-6080-442e-bcfb-533ab1e4714d
X-Cache
Miss from cloudfront
Content-Type
image/jpeg
X-Amzn-Trace-Id
Root=1-5fcff2f2-791bda900453b0d97cb1f4f5;Sampled=0
Connection
keep-alive
x-amz-apigw-id
XQLl1FNDIAMF78Q=
Content-Length
4
X-Amz-Cf-Id
obT0u0aRBpNGNoQgRic44ELuaC461H2N2STRYibg0NtBQRVPcg6eoQ==

Redirect headers

Pragma
no-cache
Date
Tue, 08 Dec 2020 21:41:05 GMT
X-Proxy-Origin
77.243.191.249; 77.243.191.249; 722.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.164:80
AN-X-Request-Uuid
c3be47e2-cc6b-4374-866a-409785e5de3f
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://attr.ml-api.io/?domain=fireeye.com&pId=8935603327613753185
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
analytics.js
www.google-analytics.com/
46 KB
18 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
3075
date
Tue, 08 Dec 2020 20:49:50 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Tue, 08 Dec 2020 22:49:50 GMT
lftracker_v1_3P1w24dgrmJ7mY5n.js
lftracker.leadfeeder.com/
10 KB
5 KB
Script
General
Full URL
https://lftracker.leadfeeder.com/lftracker_v1_3P1w24dgrmJ7mY5n.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
61bdf8263399930987db53ce794ca3e2b51474fe5a6680a51eb9198fe032b9dd

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
null
content-encoding
gzip
last-modified
Tue, 03 Nov 2020 10:55:50 GMT
server
AmazonS3
age
727
etag
"a8055c3f30ef1142e2826ba414f2bbd5"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 043fc2faaa02eeb59193e3fa300adb6b.cloudfront.net (CloudFront)
cache-control
max-age=3600
date
Tue, 08 Dec 2020 21:28:59 GMT
x-amz-cf-pop
AMS1-C1
x-amz-cf-id
sJJfeSHnBk6XjCIjeW_EQ-GhVym6MuOzmpjovwxIwAcUNhAY8My8sA==
insight.beta.min.js
snap.licdn.com/li.lms-analytics/
4 KB
2 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:05 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Sep 2020 22:01:48 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=33505
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1799
313630683245423
connect.facebook.net/signals/config/
239 KB
69 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/313630683245423?v=2.9.29&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
bad322c7b8f6fde37d48c8fac18bb81383eae6b42c2e4e170712ca3b1e39cfcc
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
70231
x-xss-protection
0
pragma
public
x-fb-debug
n4rSbWrUxHemeD/2jG0DYx5zIhxlAa36dvfvhXvlpvXdMsbUd7mlJkjg6rClgwjaeny1Zx19qsoKY8hl6lThWg==
x-fb-trip-id
603378373
x-frame-options
DENY
date
Tue, 08 Dec 2020 21:41:05 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-content-id
440688640
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
www.google-analytics.com/j/
2 B
68 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=21730105&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&ul=en-us&de=UTF-8&dt=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1974690991&gjid=654466984&cid=995697862.1607463665&tid=UA-363943-1&_gid=643323586.1607463665&_r=1&gtm=2wgbu0MVGC8KK&cd39=995697862.1607463665&z=920800034
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 21:41:05 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
6si.min.js
j.6sc.co/
15 KB
7 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.70.122 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-70-122.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
779651bc146d489786b9b4ab590d2784547448e4b85cf1bb9036b31e404d1a37

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:05 GMT
Content-Encoding
gzip
Last-Modified
Thu, 24 Sep 2020 22:09:24 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5f6d1914-3a6c"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
6116
truncated
/
17 KB
17 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
fireicons.woff
www.fireeye.com/content/dam/fireeye-www/fw/f/
72 KB
37 KB
Font
General
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rk
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.fireeye.com
Referer
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
11467
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
36804
cf-request-id
06e5e616b00000d6eda197b000000001
last-modified
Tue, 24 Sep 2019 21:47:18 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-font-woff
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a60449a6d6ed-FRA
expires
Wed, 16 Dec 2020 21:41:05 GMT
collect
stats.g.doubleclick.net/j/
4 B
88 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-363943-1&cid=995697862.1607463665&jid=1974690991&gjid=654466984&_gid=643323586.1607463665&_u=YEBAAEAAAAAAAC~&z=2125631831
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 08 Dec 2020 21:41:05 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/
5 KB
5 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1607463665356&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.htm...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26time%3D1607463665356%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1607463665356&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.htm...
0
56 B
Image
General
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1607463665356&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2%3Dundefined&liSync=true
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lva1
x-li-proto
http/2
x-li-pop
prod-efr5
content-type
application/javascript
content-length
0
x-li-uuid
HeHf7a/bThagzsfhWisAAA==

Redirect headers

content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options
nosniff
linkedin-action
1
content-length
0
x-li-uuid
ti7V6a/bThaQSAuTpisAAA==
pragma
no-cache
x-li-pop
afd-prod-lva1
x-msedge-ref
Ref A: BECB38A537574044BA1FD80F537E44F7 Ref B: FRAEDGE1519 Ref C: 2020-12-08T21:41:05Z
x-frame-options
sameorigin
date
Tue, 08 Dec 2020 21:41:05 GMT
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security
max-age=2592000
x-li-fabric
prod-lva1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1607463665356&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2%3Dundefined&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
adsct
t.co/i/
43 B
447 B
Image
General
Full URL
https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
120
pragma
no-cache
last-modified
Tue, 08 Dec 2020 21:41:05 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
140a1ccfe18e2c92a24a6fb33ed2ff73
x-transaction
00c11e85006c98db
expires
Tue, 31 Mar 1981 05:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-363943-1&cid=995697862.1607463665&jid=1974690991&_u=YEBAAEAAAAAAAC~&z=2109517639
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 21:41:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-363943-1&cid=995697862.1607463665&jid=1974690991&_u=YEBAAEAAAAAAAC~&z=2109517639
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 21:41:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/
44 B
146 B
Image
General
Full URL
https://www.facebook.com/tr/?id=313630683245423&ev=PageView&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&rl=&if=false&ts=1607463665372&sw=1600&sh=1200&v=2.9.29&r=stable&ec=0&o=30&fbp=fb.1.1607463665370.473704153&it=1607463665265&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Tue, 08 Dec 2020 21:41:05 GMT
/
tr.lfeeder.com/
43 B
292 B
Image
General
Full URL
https://tr.lfeeder.com/?sid=3P1w24dgrmJ7mY5n&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTM2Mzk0My0xIl0sImdhQ2xpZW50SWRzIjpbIjk5NTY5Nzg2Mi4xNjA3NDYzNjY1Il0sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjIuMC4wIn0sInBhZ2VVcmwiOiJodHRwczovL3d3dy5maXJlZXllLmNvbS9ibG9nL3RocmVhdC1yZXNlYXJjaC8yMDIwLzEyL3VuYXV0aG9yaXplZC1hY2Nlc3Mtb2YtZmlyZWV5ZS1yZWQtdGVhbS10b29scy5odG1sPzIiLCJwYWdlVGl0bGUiOiJVbmF1dGhvcml6ZWQgQWNjZXNzIG9mIEZpcmVFeWUgUmVkIFRlYW0gVG9vbHMgfCBGaXJlRXllIEluYyIsInJlZmVycmVyIjoiIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRUaW1lc3RhbXAiOiIyMDIwLTEyLTA4VDIxOjQxOjA1LjM3NVoiLCJjbGllbnRUaW1lem9uZSI6LTYwLCJzY3JpcHRJZCI6IjNQMXcyNGRncm1KN21ZNW4iLCJjb29raWVzRW5hYmxlZCI6dHJ1ZSwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuZWJhZTVkZjEyNWE2NTljMi4xNjA3NDYzNjY1Mzc1IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fX0=
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.68.74 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
CloudFront /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
via
1.1 6b38a2e1db230db568190464ab7177db.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
FRA56-C1
x-cache
LambdaGeneratedResponse from cloudfront
content-type
image/gif
content-length
43
x-amz-cf-id
se8R8ho6gIeru9gk_eNoofDKDq7hRr-eoJUC8q0C9lwxi3XTQzOLog==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/?random=1607463665381&cv=9&fst=1607463665381&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgbu0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&tiba=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
39f73478283b96045ddddd09312d292053b99f02a3ecb14d2448334dce1b42e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
1074
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/968899429/
42 B
530 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/968899429/?random=1607463665381&cv=9&fst=1607461200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgbu0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&tiba=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=2142302628&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 21:41:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/968899429/
42 B
530 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/968899429/?random=1607463665381&cv=9&fst=1607461200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgbu0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&tiba=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=2142302628&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 21:41:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
init
jukebox.pathfactory.com/api/public/v1/ Frame
0
0
Other
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-9AC90F09-10427&image=https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png&title=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Protocol
H2
Server
54.84.216.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-216-236.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/
28 KB
7 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
vip0x00f.map2.ssl.hwcdn.net
Software
/
Resource Hash
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 18:35:20 GMT
etag
"1544639720"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
6591
css
fonts.googleapis.com/
4 KB
726 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,700
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
083be3c59862e11bbcda4128a12a7d9934f461ac881ed75af92b1c1b3615c576
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 08 Dec 2020 20:23:36 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
date
Tue, 08 Dec 2020 21:41:05 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
expires
Tue, 08 Dec 2020 21:41:05 GMT
init
jukebox.pathfactory.com/api/public/v1/
354 B
862 B
XHR
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-9AC90F09-10427&image=https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png&title=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.216.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-216-236.compute-1.amazonaws.com
Software
/
Resource Hash
ddeec9dced8be575598e18285dac68896a44a1a39645c772ec6bebd284384067
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 08 Dec 2020 21:41:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin, Accept-Encoding
x-request-id
fa31e8ae-22e2-428d-8d91-4b38859294a7
x-runtime
0.012183
referrer-policy
no-referrer-when-downgrade
etag
W/"ddeec9dced8be575598e18285dac6889"
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
/
c.6sc.co/
47 B
371 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.70.122 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-70-122.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a50e47b011c842574eb42710c3b99650a6298701eb3de31109ad4cc52c636d4b

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:05 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.fireeye.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
getuidj
secure.adnxs.com/
11 B
704 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.243 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 08 Dec 2020 21:41:05 GMT
X-Proxy-Origin
77.243.191.249; 77.243.191.249; 722.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.59:80
AN-X-Request-Uuid
2206a2e4-b5b8-4542-983e-f11689827a29
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.fireeye.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
notification.d46d7db1.mp3
js.driftqa.com/conductor/assets/media/
20 KB
21 KB
Media
General
Full URL
https://js.driftqa.com/conductor/assets/media/notification.d46d7db1.mp3
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.229.202.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-229-202-186.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=0-

Response headers

x-amz-server-side-encryption
AES256
date
Tue, 08 Dec 2020 21:41:05 GMT
last-modified
Tue, 08 Dec 2020 19:34:02 GMT
server
nginx
access-control-allow-origin
*
etag
"d46d7db110874da77e094dcbc4bec8e6"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
audio/mpeg
Content-Range
bytes 0-20896/20897
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length
20897
details
epsilon.6sense.com/v1/company/ Frame
0
0
Other
General
Full URL
https://epsilon.6sense.com/v1/company/details
Protocol
H2
Server
18.195.61.105 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-61-105.eu-central-1.compute.amazonaws.com
Software
nginx/1.16.0 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
authorization,epsiloncookie
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
server
nginx/1.16.0
access-control-allow-origin
https://www.fireeye.com
access-control-allow-credentials
true
access-control-max-age
1800
access-control-allow-methods
OPTIONS,GET
access-control-allow-headers
authorization,epsiloncookie
details
epsilon.6sense.com/v1/company/
518 B
540 B
XHR
General
Full URL
https://epsilon.6sense.com/v1/company/details
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.61.105 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-61-105.eu-central-1.compute.amazonaws.com
Software
nginx/1.16.0 /
Resource Hash
e805e9bb73863ab80d06660d97d22c961d3d7795f1399739b17ed739a5ea6677

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Authorization
Token 325d6d60e24c7cfc3a782839d85ce08c8d3bb27c
EpsilonCookie
6fb51002db480000f1f2cf5fac01000036c40d00

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
content-encoding
gzip
server
nginx/1.16.0
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.fireeye.com
access-control-allow-credentials
true
content-length
350
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=6fb51002db480000f1f2cf5fac01000036c40d00&visitor=3ca43a72-897d-4b03-89a5-917173f43537&session=d7821315-be16-4eab-80d8-afec1ab34a5c&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22A%20state-sponsored%20adversary%20stole%20FireEye%20Red%20Team%20tools%2C%20so%20we%20are%20releasing%20hundreds%20of%20countermeasures%20to%20ensure%20the%20security%20community%20is%20protected.%5Cn%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc%22%7D&cb=63665619&r=&thirdParty=%7B%7D&pageURL=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.70.122 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-70-122.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:05 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:51:25 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e5026ad-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
/
www.facebook.com/tr/
44 B
100 B
Image
General
Full URL
https://www.facebook.com/tr/?id=313630683245423&ev=Microdata&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&rl=&if=false&ts=1607463665875&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc%22%2C%22meta%3Adescription%22%3A%22A%20state-sponsored%20adversary%20stole%20FireEye%20Red%20Team%20tools%2C%20so%20we%20are%20releasing%20hundreds%20of%20countermeasures%20to%20ensure%20the%20security%20community%20is%20protected.%5Cn%22%7D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%22%2C%22og%3Atype%22%3A%22website%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png%22%2C%22og%3Adescription%22%3A%22A%20state-sponsored%20adversary%20stole%20FireEye%20Red%20Team%20tools%2C%20so%20we%20are%20releasing%20hundreds%20of%20countermeasures%20to%20ensure%20the%20security%20community%20is%20protected.%5Cn%22%2C%22og%3Asite_name%22%3A%22FireEye%22%7D&cd[Schema.org]=%5B%7B%22dimensions%22%3A%7B%22h%22%3A86%2C%22w%22%3A1600%7D%2C%22properties%22%3A%7B%7D%2C%22subscopes%22%3A%5B%5D%2C%22type%22%3A%22http%3A%2F%2Fschema.org%2FWebPage%22%7D%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.29&r=stable&ec=1&o=30&fbp=fb.1.1607463665370.473704153&it=1607463665265&coo=false&dpo=LDU&dpoco=0&dpost=0&es=automatic&tm=3&rqm=GET
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:05 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Tue, 08 Dec 2020 21:41:05 GMT
truncated
/
17 KB
17 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
17 KB
17 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
17 KB
17 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
18 KB
18 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3091b6187cdf72d32615fd3df8c882e3cf6ca0f3e8b010d5f4f937ab2d619d94

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
5 KB
5 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
5 KB
5 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0e28cd255cac05ac63cb7b021b9436cbf1bd24b34218edefc7b9675bbcb6dec7

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
getForm
www2.fireeye.com/index.php/form/
8 KB
2 KB
Script
General
Full URL
https://www2.fireeye.com/index.php/form/getForm?munchkinId=848-DID-242&form=3353&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html&callback=jQuery11240626913693515815_1607463665970&_=1607463665971
Requested by
Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
115b528cf619151d36436707ea9d530cf4d7264f277553bdeb924c672b182738

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-request-id
06e5e6194700001e6d3c180000000001
content-encoding
gzip
server
cloudflare
date
Tue, 08 Dec 2020 21:41:06 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
5fe9a6087a951e6d-AMS
cached
true
moatframe.js
z.moatads.com/addthismoatframe568911941483/
2 KB
1 KB
Script
General
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-216-96.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:06 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
6CDA04CEF72D568E
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=52822
accept-ranges
bytes
content-length
948
x-amz-id-2
vmrAbpbzrBs8g4V4M3AoGAqwWb0EhELJ1wy9AWvX/tuPVstbiwgv0ja/UaK2kknp20dNDPCNIa4=
me
js.maxmind.com/geoip/v2.1/country/
771 B
979 B
XHR
General
Full URL
https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:252f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
89f7d91eed427a69a989c9c77830d78a3758b5350fed0d8cb0d48ff25509c535

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:06 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin
*
cf-ray
5fe9a608d956c27c-FRA
content-length
771
cf-request-id
06e5e619880000c27c959ea000000001
segmentation.segment.js
www.fireeye.com/etc/
0
174 B
XHR
General
Full URL
https://www.fireeye.com/etc/segmentation.segment.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:06 GMT
x-content-type-options
nosniff, nosniff
cf-cache-status
REVALIDATED
x-vhost
publish
vary
User-Agent, Accept-Encoding
content-length
0
cf-request-id
06e5e6198a0000d6edb9809000000001
cf-bgj
minify
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"d41d8cd98f00b204e9800998ecf8427e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
5fe9a608db17d6ed-FRA
expires
Wed, 16 Dec 2020 21:41:06 GMT
stores.init.js
www.fireeye.com/etc/clientcontext/default/content/jcr:content/
3 KB
1 KB
XHR
General
Full URL
https://www.fireeye.com/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools&_=1607463665163
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
212393b53a162ea5e1160b6207be7827fa1e1e995a72a60c3a6fa00f5b82fead
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:06 GMT
content-encoding
gzip
vary
Accept-Encoding
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
5fe9a608eb24d6ed-FRA
cf-request-id
06e5e6198d0000d6edb0278000000001
expires
Thu, 01 Jan 1970 00:00:01 GMT
munchkin.js
munchkin.marketo.net/159/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/159/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-95-62.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:06 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 May 2020 02:24:14 GMT
Server
AkamaiNetStorage
ETag
"79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4810
Expires
Thu, 18 Mar 2021 21:41:06 GMT
read-blogentries
www.fireeye.com/bin/www-blogs/
98 KB
17 KB
XHR
General
Full URL
https://www.fireeye.com/bin/www-blogs/read-blogentries?categoryPath=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93d980ad435b662fb84e90a74983dcbb7705ccb06a14b2e9285528269861c122
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Tue, 08 Dec 2020 21:41:07 GMT
content-encoding
gzip
x-content-type-options
nosniff, nosniff
cf-cache-status
DYNAMIC
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
17570
x-xss-protection
1; mode=block
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id
06e5e6198e0000d6edaeb07000000001
cf-ray
5fe9a608eb29d6ed-FRA
adsct
analytics.twitter.com/i/
31 B
650 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
x-response-time
112
pragma
no-cache
last-modified
Tue, 08 Dec 2020 21:41:07 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
26f40ec45fec7d214b5c0f9aac4419ca
x-transaction
009f682f0070d691
expires
Tue, 31 Mar 1981 05:00:00 GMT
MultiNoun.jsonp
d.la2c2.salesforceliveagent.com/chat/rest/System/
226 B
591 B
Script
General
Full URL
https://d.la2c2.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.108.250.7 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl5-ord.la1-c2-ord.salesforceliveagent.com
Software
/
Resource Hash
0a5039b3de32aa24fae1e72efac134543cc2be01fa22485898e1b0a9205075f8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Expires
-1
_ate.track.config_resp
v1.addthisedge.com/live/boost/fewebadmin/
4 KB
1 KB
Script
General
Full URL
https://v1.addthisedge.com/live/boost/fewebadmin/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5cd804ec7036cddeb6403cd02cb908ebc248fe66e865dfc205df718463e3167c

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:07 GMT
content-encoding
gzip
etag
-1477460652--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=5, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
899
300lo.json
m.addthis.com/live/red_lojson/
90 B
250 B
Script
General
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=5fcff2f2bae679fa&bkl=0&bl=1&pdt=1003&sid=5fcff2f2bae679fa&pub=fewebadmin&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.fireeye.com&fp=blog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=0&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1607463667129&jsl=8193&uvs=5fcff2f2ab80c07f000&skipb=1&callback=addthis.cbs.jsonp__243340179622488770
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e68ee99300a311a6c4448d6567980cb3e60474453c4738d25ee5725211a57dbf

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 21:41:07 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
content-length
90
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 9F80
0
0

sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 7D56
0
0
Document
General
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:method
GET
:authority
s7.addthis.com
:scheme
https
:path
/static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2

Response headers

server
nginx/1.15.8
content-type
text/html
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
etag
W/"5ed917ff-11adc"
timing-allow-origin
*
cache-control
public, max-age=86313600
p3p
CP="NON ADM OUR DEV IND COM STA"
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
content-length
26421
date
Tue, 08 Dec 2020 21:41:07 GMT
vary
Accept-Encoding
x-host
s7.addthis.com
0
bat.bing.com/action/
0
115 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5870833&Ver=2&mid=bd6b43d2-f5cf-4ef0-929b-d1378beb129f&sid=14322990399e11eba464cf22d2b8d53a&vid=14322de0399e11ebbbb2313a5425c086&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&p=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&r=&lt=3008&evt=pageLoad&msclkid=N&sv=1&rn=885627
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 08 Dec 2020 21:41:06 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 0A3B9AA6C02D4981A03948D0050F3D22 Ref B: FRAEDGE1413 Ref C: 2020-12-08T21:41:07Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
sp.js
cdnjs.cloudflare.com/ajax/libs/snowplow/2.16.2/
77 KB
24 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/snowplow/2.16.2/sp.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e791cea0b4e689b8d862850ce773d23b07402255ace1c27e1a55e90cccd88f7
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:07 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
397113
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
23741
cf-request-id
06e5e61ddc0000975ab7864000000001
timing-allow-origin
*
last-modified
Mon, 19 Oct 2020 20:35:00 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5f8df874-134e9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Mt9OYX3A1vC3H%2BMqYZjfn7EtrLA8RhVMRNSZI%2F6LyyVjR5Dzu%2FRE23O%2F72KYu9%2BqcJz9GM7c%2FUVat4FuBfZsPBgY2HWU0olcH0a1oTy2eRSAKWI3aQIMneyWym8ts%2BNSqw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5fe9a60fc95a975a-FRA
expires
Sun, 28 Nov 2021 21:41:07 GMT
website_experience
jukebox.pathfactory.com/api/public/v1/ Frame
0
0
Other
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=abf53b4f-1faa-4a5b-82b8-9fcb06d7fc8b&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Protocol
H2
Server
54.84.216.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-216-236.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 08 Dec 2020 21:41:07 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
website_experience
jukebox.pathfactory.com/api/public/v1/
0
412 B
XHR
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=abf53b4f-1faa-4a5b-82b8-9fcb06d7fc8b&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.216.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-216-236.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

x-runtime
0.033488
date
Tue, 08 Dec 2020 21:41:07 GMT
referrer-policy
no-referrer-when-downgrade
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
no-cache
access-control-allow-credentials
true
vary
Origin
x-content-type-options
nosniff
x-request-id
47da75b3-5293-4036-9949-64845c40599b
conversion.js
s.yimg.jp/images/listing/tool/cv/
6 KB
2 KB
Script
General
Full URL
https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
183.79.219.124 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),
Reverse DNS
Software
ATS /
Resource Hash
9e3a9103c80346b1b39bea3de46f44a462b3f594fa45e7206252bc41d7e3e855

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion
1
date
Tue, 08 Dec 2020 21:39:32 GMT
content-encoding
gzip
last-modified
Wed, 30 Sep 2020 06:06:44 GMT
server
ATS
age
95
vary
Accept-Encoding
p3p
policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
via
http/1.1 edge2767.img.kth.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge2730.img.kth.yahoo.co.jp (ApacheTrafficServer [cMsSfW])
cache-control
public, max-age=600
accept-ranges
bytes
content-type
application/javascript
content-length
1997
expires
Tue, 08 Dec 2020 21:49:32 GMT
forms2.css
www2.fireeye.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://www2.fireeye.com/js/forms2/css/forms2.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6679
content-length
2623
cf-request-id
06e5e61df100001e6d5cbfc000000001
last-modified
Mon, 12 Oct 2020 17:13:35 GMT
server
cloudflare
etag
"483e77-3437-5b17c6b21edc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5fe9a60fee531e6d-AMS
expires
Wed, 09 Dec 2020 01:41:07 GMT
forms2-theme-simple.css
www2.fireeye.com/js/forms2/css/
826 B
414 B
Stylesheet
General
Full URL
https://www2.fireeye.com/js/forms2/css/forms2-theme-simple.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6679
content-length
242
cf-request-id
06e5e61df100001e6d44a7d000000001
last-modified
Mon, 12 Oct 2020 17:13:35 GMT
server
cloudflare
etag
"4e136d-33a-5b17c6b21edc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5fe9a60fee581e6d-AMS
expires
Wed, 09 Dec 2020 01:41:07 GMT
visitWebPage
848-did-242.mktoresp.com/webevents/
2 B
311 B
XHR
General
Full URL
https://848-did-242.mktoresp.com/webevents/visitWebPage?_mchNc=1607463667180&_mchCn=&_mchId=848-DID-242&_mchTk=_mch-fireeye.com-1607463667179-42163&_mchHo=www.fireeye.com&_mchPo=&_mchRu=%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html&_mchPc=https%3A&_mchVr=159&_mchEcid=&_mchHa=&_mchRe=&_mchQp=2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:07 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
2ca1fe9c-959c-405f-8d83-2d8c8faafad2
tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ Frame
0
0
Other
General
Full URL
https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol
HTTP/1.1
Server
23.20.13.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-20-13-199.compute-1.amazonaws.com
Software
akka-http/10.0.9 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Content-Type
Access-Control-Allow-Origin
https://www.fireeye.com
Access-Control-Max-Age
5
Date
Tue, 08 Dec 2020 21:41:07 GMT
Server
akka-http/10.0.9
Content-Length
0
Connection
keep-alive
tp2
jukebox.pathfactory.com/com.snowplowanalytics.snowplow/ Frame
0
0
Other
General
Full URL
https://jukebox.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol
H2
Server
54.84.216.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-216-236.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 08 Dec 2020 21:41:07 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/
2 B
460 B
XHR
General
Full URL
https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.20.13.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-20-13-199.compute-1.amazonaws.com
Software
akka-http/10.0.9 /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Date
Tue, 08 Dec 2020 21:41:07 GMT
Server
akka-http/10.0.9
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin
https://www.fireeye.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/plain; charset=UTF-8
Content-Length
2
tp2
jukebox.pathfactory.com/com.snowplowanalytics.snowplow/
0
420 B
XHR
General
Full URL
https://jukebox.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.216.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-216-236.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

x-runtime
0.006585
date
Tue, 08 Dec 2020 21:41:07 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
vary
Origin, Accept-Encoding
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
text/html
access-control-allow-origin
https://www.fireeye.com
access-control-max-age
1728000
cache-control
no-cache
access-control-allow-credentials
true
x-content-type-options
nosniff
x-request-id
db9bc569-a98c-44cd-90ea-81469167a8ab
access-control-expose-headers
layers.fa6cd1947ce26e890d3d.js
s7.addthis.com/static/
263 KB
76 KB
Script
General
Full URL
https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-41cf5"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Tue, 08 Dec 2020 21:41:07 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77617
collect
www.google-analytics.com/
35 B
63 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j87&a=21730105&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&ul=en-us&de=UTF-8&dt=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20views%20with%20form&ea=view&el=Form&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=995697862.1607463665&tid=UA-363943-1&_gid=643323586.1607463665&gtm=2wgbu0MVGC8KK&cd3=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&cd17=Form&cd18=3353&cd19=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&z=1138107750
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 01:35:33 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
72334
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
me
abm2.listenloop.com/api/v1/public/organizations/
574 B
1 KB
XHR
General
Full URL
https://abm2.listenloop.com/api/v1/public/organizations/me?public_key=MRxJc5qdz5T-wKxBNsh4
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.224.123.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-224-123-127.compute-1.amazonaws.com
Software
nginx /
Resource Hash
56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628

Request headers

Accept
*/*
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Runtime
0.006079
Date
Tue, 08 Dec 2020 21:41:07 GMT
Content-Encoding
gzip
Server
nginx
ETag
W/"1d1754d8453d1b9213466414d142afcb"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.fireeye.com
Cache-Control
max-age=0, private, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Authorization
Content-Length
361
X-Request-Id
022224e4-a123-4717-852f-0ee91d893667
retargeting_segments
abm2.listenloop.com/api/v1/public/
27 B
774 B
XHR
General
Full URL
https://abm2.listenloop.com/api/v1/public/retargeting_segments
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.224.123.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-224-123-127.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0

Request headers

Accept
*/*
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

X-Runtime
0.006863
Date
Tue, 08 Dec 2020 21:41:07 GMT
Content-Encoding
gzip
Server
nginx
ETag
W/"8eb510da42f9c57c977e4997f9a8c8bf"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.fireeye.com
Cache-Control
max-age=0, private, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Authorization
Content-Length
53
X-Request-Id
2ec7fbf6-e485-4539-8564-c7145550bcce
XDFrame
www2.fireeye.com/index.php/form/ Frame A379
2 KB
888 B
Document
General
Full URL
https://www2.fireeye.com/index.php/form/XDFrame
Requested by
Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:method
GET
:authority
www2.fireeye.com
:scheme
https
:path
/index.php/form/XDFrame
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d0ac956d83f72caedfc0960796524c4b31607463664; _gcl_au=1.1.1571942375.1607463665; _ga=GA1.2.995697862.1607463665; _gid=GA1.2.643323586.1607463665; _gat_UA-363943-1=1; __cf_bm=f8fd0aa320748210e6a921af656faa58a2213ba4-1607463665-1800-AU138xQk2QRJF1WxHCzPAVGsEGeibqQDzXHu3Jl+KsSj5DI9tyQxsz7X38+w5t0dtHnHFUutAk0X/E1rh/CTDA0=; _fbp=fb.1.1607463665370.473704153; _lfa=eyIzUDF3MjRkZ3JtSjdtWTVuIjoiTEYxLjEuZWJhZTVkZjEyNWE2NTljMi4xNjA3NDYzNjY1Mzc1In0%3D; vid=abf53b4f-1faa-4a5b-82b8-9fcb06d7fc8b; _uetsid=14322990399e11eba464cf22d2b8d53a; _uetvid=14322de0399e11ebbbb2313a5425c086; _mkto_trk=id:848-DID-242&token:_mch-fireeye.com-1607463667179-42163; _pf_ses.81ef=*; _pf_id.81ef=abf53b4f-1faa-4a5b-82b8-9fcb06d7fc8b.1607463667.1.1607463667.1607463667.38d26041-2059-4332-8a13-6684f422f288
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2

Response headers

date
Tue, 08 Dec 2020 21:41:07 GMT
content-type
text/html; charset=utf-8
cache-control
max-age=3600
x-content-type-options
nosniff
vary
Accept-Encoding
set-cookie
BIGipServersjiweb-nginx-app_https=!pX5877iSoxZTa4/InuzRy4alk/3R/nR7YRQeNSqLfvBzY2+3++s3ygJfmw/ypzjbqx8/O8CPXuoYSsE=;Path=/;Version=1;Secure;Httponly
cf-cache-status
DYNAMIC
cf-request-id
06e5e61e5d00001e6d7334d000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5fe9a610982e1e6d-AMS
content-encoding
gzip
website_forms
jukebox.pathfactory.com/api/public/v1/ Frame
0
0
Other
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-9AC90F09-10427&visitorUuid=abf53b4f-1faa-4a5b-82b8-9fcb06d7fc8b&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Protocol
H2
Server
54.84.216.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-216-236.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 08 Dec 2020 21:41:07 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
website_forms
jukebox.pathfactory.com/api/public/v1/
0
411 B
XHR
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-9AC90F09-10427&visitorUuid=abf53b4f-1faa-4a5b-82b8-9fcb06d7fc8b&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.216.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-216-236.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

x-runtime
0.013523
date
Tue, 08 Dec 2020 21:41:07 GMT
referrer-policy
no-referrer-when-downgrade
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
no-cache
access-control-allow-credentials
true
vary
Origin
x-content-type-options
nosniff
x-request-id
860110ba-69b3-49d2-8251-3034facfae1b
forms2.min.js
www2.fireeye.com/js/forms2/js/ Frame A379
205 KB
68 KB
Script
General
Full URL
https://www2.fireeye.com/js/forms2/js/forms2.min.js
Requested by
Host: www2.fireeye.com
URL: https://www2.fireeye.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dde2a7cd4331f78a4b35dca9aa2e716fc3d0c83ba0f855f0812cbfae4a27a805
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www2.fireeye.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:41:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Mon, 12 Oct 2020 17:13:35 GMT
server
cloudflare
age
3123
etag
"4a0b51-33245-5b17c6b21edc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
5fe9a6122d271e6d-AMS
cf-request-id
06e5e61f5400001e6d43a2b000000001
expires
Wed, 09 Dec 2020 01:41:07 GMT
MultiNoun.jsonp
d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/
497 B
759 B
Script
General
Full URL
https://d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.110.64.53 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS
Software
/
Resource Hash
5cde53806b876fdc810c50cf9564e5bf7a765cb6ab11681581b5e3162aa27f99
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Expires
-1
associate-segment
segment.prod.bidr.io/
Redirect Chain
  • https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=
  • https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1
43 B
793 B
Image
General
Full URL
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.209.184.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
Date
Tue, 08 Dec 2020 21:41:07 GMT
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control
no-cache, must-revalidate
Connection
keep-alive
content-type
image/gif
Content-Length
43
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1
Date
Tue, 08 Dec 2020 21:41:07 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=2592000; includeSubDomains
/
b91.yahoo.co.jp/pagead/conversion/1000244663/
7 B
917 B
Image
General
Full URL
https://b91.yahoo.co.jp/pagead/conversion/1000244663/?random=1607463667990&cv=9&fst=1607463667990&num=1&fmt=3&value=0&label=ppcGCKvb3mcQ_c2swgM&guid=ON&disvt=true&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&tiba=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
183.79.255.28 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 08 Dec 2020 21:41:09 GMT
Via
http/1.1 mscedge2105.img.umd.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options
nosniff
Server
ATS
Timing-Allow-Origin
*
Age
0
P3P
policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control
no-cache, must-revalidate, private
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Content-Type
image/gif
Content-Length
7
X-XSS-Protection
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
ytc.js
s.yimg.com/wi/
15 KB
6 KB
Script
General
Full URL
https://s.yimg.com/wi/ytc.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),
Reverse DNS
Software
ATS /
Resource Hash
63896532a7015ab5b7288359c02124980a5075e9267f0ba3fbfc7c3f5038b478
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion
1
date
Tue, 08 Dec 2020 21:39:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
108
x-amz-server-side-encryption
AES256
vary
Origin, Accept-Encoding
content-length
5581
x-amz-id-2
0Z2BLbp+gjxP9iY2C5SEY07mzRBtw1UA7gIiCSte3/tofkFNg9Ra+a1Yb/c88OiR/4EFAKODH8E=
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Sat, 30 Oct 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Thu, 24 Sep 2020 23:08:16 GMT
server
ATS
etag
"49db10c8315384e8dad2e92a6841ed81-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
x-amz-request-id
132FE3F5A9520924
x-xss-protection
1; mode=block
cache-control
public,max-age=3600
x-amz-version-id
swANRqp_TdPZf97XDKuCKoVnrp7c.h.0
accept-ranges
bytes
content-type
application/javascript
json
fireeye.tt.omtrdc.net/m2/fireeye/mbox/
5 KB
946 B
XHR
General
Full URL
https://fireeye.tt.omtrdc.net/m2/fireeye/mbox/json?mbox=target-global-mbox&mboxSession=cd6b1a416f964020b59f907f8b48f506&mboxPC=&mboxPage=18167b28aeb148a896fd97c2c828df03&mboxRid=606125b3ab924c1c9d5837ff055c08d9&mboxVersion=1.7.1&mboxCount=1&mboxTime=1607467268011&mboxHost=www.fireeye.com&mboxURL=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=60&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&companyRevenueRange=%2450M%20-%20%24100M&companyCountry=Belgium&companyIndustry=Retail%20and%20Distribution&companyName=Vente%20-%20Exclusive.com&companyRegion=Western%20Europe&companyDomain=veepee.be&segments=%5B%5D
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.9.158 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
1f80b140c54cac6fb1568080c0f8744bb3cccebbb86bbd3a20b42805b590bdb8

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 21:41:08 GMT
content-encoding
gzip
vary
Origin,Accept-Encoding
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.fireeye.com
cache-control
no-cache
access-control-allow-credentials
true
timing-allow-origin
*
x-request-id
606125b3ab924c1c9d5837ff055c08d9
435600.json
s.yimg.com/wi/config/
2 B
203 B
XHR
General
Full URL
https://s.yimg.com/wi/config/435600.json
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),
Reverse DNS
Software
ATS /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 21:37:42 GMT
x-content-type-options
nosniff
age
206
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id
4FEB53EAC6B7E457
x-amz-id-2
kA3zMBIw5qbkmdrBKmM29P/bKqT8WtgUTD03ggcw0g5NmrqBtggGQmTfh9/HeoDRE2jRFUc+ZL8=
referrer-policy
no-referrer-when-downgrade
server
ATS
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
public,max-age=3600
content-length
2
sp.pl
sp.analytics.yahoo.com/
0
933 B
Script
General
Full URL
https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Tue%2C%2008%20Dec%202020%2021%3A41%3A08%20GMT&n=-1&b=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&.yp=435600&f=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&enc=UTF-8&tagmgr=gtm%2Cadobe
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
spdc.pbp.vip.ir2.yahoo.com
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 08 Dec 2020 21:41:08 GMT
X-Content-Type-Options
nosniff
Age
0
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Server
ATS
X-Frame-Options
DENY
Expect-CT
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security
max-age=31536000
Content-Type
application/x-javascript
Cache-Control
no-cache, private, must-revalidate
Accept-Ranges
bytes
Expires
Tue, 08 Dec 2020 21:41:08 GMT
page_views
abm2.listenloop.com/api/v1/public/
356 B
965 B
XHR
General
Full URL
https://abm2.listenloop.com/api/v1/public/page_views
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.224.123.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-224-123-127.compute-1.amazonaws.com
Software
nginx /
Resource Hash
f329a255f4defd28c27a450fa767584c408d995966533ef9307434d4d7bcfbac

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

X-Runtime
0.918240
Date
Tue, 08 Dec 2020 21:41:10 GMT
Content-Encoding
gzip
Server
nginx
ETag
W/"c318550c887b72c4632661a9224b257d"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.fireeye.com
Cache-Control
max-age=0, private, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Authorization
Content-Length
243
X-Request-Id
3a80634f-544f-4702-8efa-8ca831b4056b
page_views
abm2.listenloop.com/api/v1/public/ Frame
0
0
Other
General
Full URL
https://abm2.listenloop.com/api/v1/public/page_views
Protocol
HTTP/1.1
Server
54.224.123.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-224-123-127.compute-1.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Authorization
Access-Control-Allow-Methods
GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Access-Control-Allow-Origin
https://www.fireeye.com
Date
Tue, 08 Dec 2020 21:41:09 GMT
Server
nginx
Connection
keep-alive
core
js.driftt.com/ Frame DB09
0
0
Document
General
Full URL
https://js.driftt.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=3d2f4d98-182e-47d0-a40e-886dab0d6afd&sessionStarted=1607463669&campaignRefreshToken=ab7a4041-53b7-4dff-b8a4-833881f6ea4c&pageLoadStartTime=1607463665117
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
GET
:authority
js.driftt.com
:scheme
https
:path
/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=3d2f4d98-182e-47d0-a40e-886dab0d6afd&sessionStarted=1607463669&campaignRefreshToken=ab7a4041-53b7-4dff-b8a4-833881f6ea4c&pageLoadStartTime=1607463665117
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2

Response headers

content-type
text/html; charset=utf-8
server
nginx
last-modified
Tue, 08 Dec 2020 20:07:41 GMT
x-amz-server-side-encryption
AES256
x-amz-version-id
g.mk4N_K9yKMmIosOgp5v3mD55G8FuZu
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
date
Tue, 08 Dec 2020 21:41:09 GMT
etag
"f979a791ae67003049ca028a572bebb6"
cache-control
no-cache
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
via
1.1 4d43f2ff38c53dabf47263f1495ad9c0.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS1-C1
x-amz-cf-id
fB37CKkgflVmCjizcxObSFfd3rLpAClSERYeMXRwk8Pk-ToAg2HMww==
chat
js.driftt.com/core/ Frame FEFD
0
0
Document
General
Full URL
https://js.driftt.com/core/chat
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1607463900000/wm3vc3smix6y.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
GET
:authority
js.driftt.com
:scheme
https
:path
/core/chat
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2

Response headers

content-type
text/html; charset=utf-8
server
nginx
last-modified
Tue, 08 Dec 2020 20:07:41 GMT
x-amz-server-side-encryption
AES256
x-amz-version-id
g.mk4N_K9yKMmIosOgp5v3mD55G8FuZu
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
date
Tue, 08 Dec 2020 21:41:09 GMT
etag
"f979a791ae67003049ca028a572bebb6"
cache-control
no-cache
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
via
1.1 4d43f2ff38c53dabf47263f1495ad9c0.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS1-C1
x-amz-cf-id
_R2qL1PSs5f1lHnf_nX0GvtIykPG-J5TCnQdZ1sVz9sA4yy_jCPzQw==
collect
www.google-analytics.com/
35 B
63 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j87&a=21730105&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&ul=en-us&de=UTF-8&dt=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Site%20Section&ea=FireEye%20Blogs&el=Threat%20Research&ev=0&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=995697862.1607463665&tid=UA-363943-1&_gid=643323586.1607463665&gtm=2wgbu0MVGC8KK&z=1025126898
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 01:35:33 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
72336
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
58 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j87&a=21730105&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&ul=en-us&de=UTF-8&dt=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20Scroll&ea=25&el=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=995697862.1607463665&tid=UA-363943-1&_gid=643323586.1607463665&gtm=2wgbu0MVGC8KK&z=758495016
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 01:35:33 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
72336
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
58 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j87&a=21730105&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&ul=en-us&de=UTF-8&dt=Unauthorized%20Access%20of%20FireEye%20Red%20Team%20Tools%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20Scroll&ea=50&el=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Funauthorized-access-of-fireeye-red-team-tools.html%3F2&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=995697862.1607463665&tid=UA-363943-1&_gid=643323586.1607463665&gtm=2wgbu0MVGC8KK&z=1531627388
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Dec 2020 01:35:33 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
72336
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

217 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| companyDetails6Sense object| jsonVal undefined| companyRevenueRange undefined| companyCountry undefined| companyIndustry undefined| companyName undefined| companyRegion undefined| companyDomain undefined| segments object| dataLayer function| $ function| jQuery object| matched object| browser object| Granite object| fdc object| geoip2 undefined| cookiesOK function| onAccept function| onDecline function| ipLocation string| userAgent boolean| gomezAgent boolean| prtgAgent object| _satellite object| google_tag_manager function| postscribe object| google_tag_data string| _linkedin_data_partner_id object| uetq function| twq function| fbq function| _fbq function| getParameterByName string| content_category_1 string| content_category_2 string| content_category_3 number| flag function| marketoFormSubmitGTMEvent function| bannerEvent function| validateMarketoform function| marketoFormViewGtmEvent function| getContentCategory function| fireproofFormSubmitGTMEvent object| jQuery1124027217444895815923 function| lbhq undefined| isFireProofPage object| ldfdr function| drift undefined| driftt function| getRandomInt number| random string| GoogleAnalyticsObject function| ga function| UET object| gaplugins object| gaGlobal object| gaData object| addthis_config object| addthis_share function| showCountryNotification object| _6SenseJsonObj object| _6SenseTime boolean| isJsonStale object| _6si string| jsonObj function| targetPageParams object| _g function| $CQ object| CQ undefined| G_XHR_HOOK undefined| G_RELOAD_HOOK undefined| G_IS_HOOKED undefined| G_CONTENT_PATH function| _ function| generateURLSignature function| initializeTeaserLoader function| initializeLandingPageLoader object| CQ_Analytics object| CQ_Context boolean| CQ_trackTeasersStats boolean| CQ_trackLandingPagesStats object| ClientContext object| ContextCloud object| _laq object| twttr function| lintrk boolean| _already_called_lintrk function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO function| setImmediate function| clearImmediate object| scCGSHMRCache boolean| jukeboxInitialized boolean| _storagePopulated object| true object| 3eiXJRXgVuLsYGH9303q object| regeneratorRuntime object| __SENTRY__ object| _driftFrames object| __post_robot_10_0_16__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| liveAgentDeployment object| liveagent object| MktoForms2 object| digitalData object| feedcontainerSr undefined| feedurlSr undefined| levelsFeedSr undefined| typeofEmp undefined| jobDescriptinUrlSr object| content object| jobFunctionsArray function| displayFeedSR function| filterResultsSR function| getPostings function| populateDropDowns function| replaceQueryParam function| addMissingUTMsFromCookies number| slideTotal number| currentSlide string| target function| getCurrentSlide function| showHideControls string| activeLbox function| calculateTopMargin function| closec08 function| updatec08 function| fixCta function| showNav function| showNavSub function| showNavMore function| initNav number| totalSlides function| changeSlide function| initCarousel function| msieversion undefined| intervalId function| showSuggestions undefined| startTimer function| readCookie object| html5 object| Modernizr function| yepnope object| respond function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto function| toggle_ll_logging object| GlobalSnowplowNamespace function| jukeboxTracker function| onYouTubeIframeAPIReady object| yahoo_conversion_id object| yahoo_conversion_label object| yahoo_conversion_value object| MunchkinTracker boolean| __@@##MUH object| Snowplow object| jQuery11240626913693515815 function| ll_conversion object| _atw string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks number| len object| yahoo_conversion_language object| yahoo_conversion_color object| yahoo_ss_retargeting_id object| yahoo_ss_retargeting object| yahoo_sstag_custom_params object| dotq object| adobe object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate object| YAHOO number| drift_page_view_started number| drift_session_started object| drift_event_listeners string| drift_session_id string| drift_campaign_refresh

33 Cookies

Domain/Path Name / Value
www.fireeye.com/ Name: drift_campaign_refresh
Value: ab7a4041-53b7-4dff-b8a4-833881f6ea4c
www.fireeye.com/ Name: liveagent_sid
Value: 1ca2ec57-72e2-46cd-b610-55c9c1a70cba
.addthis.com/ Name: loc
Value: MDAwMDBFVUJFMDAyMzA2MTg1NjAwMDAwMDBDSA==
.fireeye.com/ Name: mboxEdgeCluster
Value: 37
.fireeye.com/ Name: mbox
Value: session#cd6b1a416f964020b59f907f8b48f506#1607465529|PC#cd6b1a416f964020b59f907f8b48f506.37_0#1670708469
www2.fireeye.com/ Name: BIGipServersjiweb-nginx-app_https
Value: !pX5877iSoxZTa4/InuzRy4alk/3R/nR7YRQeNSqLfvBzY2+3++s3ygJfmw/ypzjbqx8/O8CPXuoYSsE=
.fireeye.com/ Name: check
Value: true
www.fireeye.com/ Name: __atuvc
Value: 1%7C50
www.fireeye.com/ Name: liveagent_ptid
Value: 8a28b85c-6d2b-495d-a557-d7afb9cf1cfb
.fireeye.com/ Name: _pf_ses.81ef
Value: *
.www2.fireeye.com/ Name: __cf_bm
Value: f8fd0aa320748210e6a921af656faa58a2213ba4-1607463665-1800-AU138xQk2QRJF1WxHCzPAVGsEGeibqQDzXHu3Jl+KsSj5DI9tyQxsz7X38+w5t0dtHnHFUutAk0X/E1rh/CTDA0=
.addthis.com/ Name: uvc
Value: 1%7C50
www.fireeye.com/ Name: __atuvs
Value: 5fcff2f2ab80c07f000
.fireeye.com/ Name: _gcl_au
Value: 1.1.1571942375.1607463665
.fireeye.com/ Name: _ga
Value: GA1.2.995697862.1607463665
.fireeye.com/ Name: _uetvid
Value: 14322de0399e11ebbbb2313a5425c086
.fireeye.com/ Name: _gid
Value: GA1.2.643323586.1607463665
www.fireeye.com/ Name: liveagent_oref
Value:
www.fireeye.com/ Name: _gd_visitor
Value: 3ca43a72-897d-4b03-89a5-917173f43537
www.fireeye.com/ Name: liveagent_vc
Value: 3
www.fireeye.com/ Name: _an_uid
Value: 0
www.fireeye.com/ Name: _gd_svisitor
Value: 6fb51002db480000f1f2cf5fac01000036c40d00
.fireeye.com/ Name: _mkto_trk
Value: id:848-DID-242&token:_mch-fireeye.com-1607463667179-42163
www.fireeye.com/ Name: _gd_session
Value: d7821315-be16-4eab-80d8-afec1ab34a5c
.fireeye.com/ Name: vid
Value: abf53b4f-1faa-4a5b-82b8-9fcb06d7fc8b
.fireeye.com/ Name: _pf_id.81ef
Value: abf53b4f-1faa-4a5b-82b8-9fcb06d7fc8b.1607463667.1.1607463667.1607463667.38d26041-2059-4332-8a13-6684f422f288
.fireeye.com/ Name: _fbp
Value: fb.1.1607463665370.473704153
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.fireeye.com/ Name: _gat_UA-363943-1
Value: 1
.fireeye.com/ Name: _uetsid
Value: 14322990399e11eba464cf22d2b8d53a
.fireeye.com/ Name: _lfa
Value: eyIzUDF3MjRkZ3JtSjdtWTVuIjoiTEYxLjEuZWJhZTVkZjEyNWE2NTljMi4xNjA3NDYzNjY1Mzc1In0%3D
.fireeye.com/ Name: __cfduid
Value: d0ac956d83f72caedfc0960796524c4b31607463664
www.fireeye.com/blog/threat-research/2020/12 Name: DriftPlaybook
Value: A

10 Console Messages

Source Level URL
Text
console-api log URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2(Line 1090)
Message:
currentPagePath :: /blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools
console-api log URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2(Line 1096)
Message:
undefined
console-api log URL: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html?2(Line 1097)
Message:
[object Object]
console-api debug URL: https://v2.listenloop.com/loop.bundle.js(Line 4)
Message:
[bugsnag] Loaded!
console-api log URL: https://v2.listenloop.com/loop.bundle.js(Line 4)
Message:
995697862.1607463665
console-api log URL: https://v2.listenloop.com/loop.bundle.js(Line 4)
Message:
cookie value
console-api log URL: https://v2.listenloop.com/loop.bundle.js(Line 4)
Message:
cookie value
console-api log URL: https://v2.listenloop.com/loop.bundle.js(Line 4)
Message:
cookie value
console-api log URL: https://v2.listenloop.com/loop.bundle.js(Line 4)
Message:
cookie value
console-api warning URL: https://v2.listenloop.com/loop.bundle.js(Line 4)
Message:
AT: Failed actions [object Object],[object Object],[object Object],[object Object]

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8443343.fls.doubleclick.net
848-did-242.mktoresp.com
abm2.listenloop.com
analytics.twitter.com
app.cdn.lookbookhq.com
attr.ml-api.io
b.6sc.co
b91.yahoo.co.jp
bat.bing.com
c.6sc.co
c.la2c2.salesforceliveagent.com
cdnjs.cloudflare.com
cloud.typography.com
connect.facebook.net
d.la1-c1-ia5.salesforceliveagent.com
d.la2c2.salesforceliveagent.com
epsilon.6sense.com
fireeye.tt.omtrdc.net
fonts.googleapis.com
googleads.g.doubleclick.net
j.6sc.co
js.driftqa.com
js.driftt.com
js.maxmind.com
jukebox.pathfactory.com
lftracker.leadfeeder.com
m.addthis.com
maxcdn.bootstrapcdn.com
munchkin.marketo.net
px.ads.linkedin.com
s.ml-attr.com
s.yimg.com
s.yimg.jp
s7.addthis.com
secure.adnxs.com
segment.prod.bidr.io
snap.licdn.com
sp.analytics.yahoo.com
spcollector.pathfactory.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tr.lfeeder.com
v1.addthisedge.com
v2.listenloop.com
www.facebook.com
www.fireeye.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www2.fireeye.com
z.moatads.com
s7.addthis.com
104.109.54.208
104.109.70.122
104.109.95.62
104.111.216.96
104.17.72.206
104.244.42.3
104.244.42.5
104.75.88.112
13.108.250.7
13.110.64.53
18.195.61.105
183.79.219.124
183.79.255.28
185.33.220.243
192.28.147.68
199.232.56.157
209.197.3.15
212.82.100.181
216.58.210.6
216.58.212.130
23.20.13.199
2606:4700:300b::a29f:f67d
2606:4700:3036::ac43:dfcf
2606:4700::6810:125e
2606:4700::6810:252f
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:f03d:1fa::4000
2a00:1450:4001:802::2004
2a00:1450:4001:80b::200e
2a00:1450:4001:815::200a
2a00:1450:4001:818::2002
2a00:1450:4001:818::2008
2a00:1450:4001:81a::2004
2a00:1450:4001:820::2003
2a00:1450:4001:824::200e
2a00:1450:400c:c09::9b
2a02:26f0:6c00:28c::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
3.229.202.186
52.209.184.14
54.224.123.127
54.75.9.158
54.84.216.236
65.9.68.124
65.9.68.74
65.9.68.84
65.9.73.13
65.9.73.80
68.67.153.60
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
083be3c59862e11bbcda4128a12a7d9934f461ac881ed75af92b1c1b3615c576
0a5039b3de32aa24fae1e72efac134543cc2be01fa22485898e1b0a9205075f8
0e28cd255cac05ac63cb7b021b9436cbf1bd24b34218edefc7b9675bbcb6dec7
0e49c2b4e86d3fda1dda93eb1210a47712f7b091181b4e7c6da2b3e6f8e86396
0f731a19e7f12a4854f3a3133b7bbf3cf80856d842f7aefd9b7545b0595aa149
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
115b528cf619151d36436707ea9d530cf4d7264f277553bdeb924c672b182738
14893102c4a2a0ddb9fc1f9d19e60e85be0390e875ea05c50be395cc8d44bdd1
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02
1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0
1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae
1f80b140c54cac6fb1568080c0f8744bb3cccebbb86bbd3a20b42805b590bdb8
212393b53a162ea5e1160b6207be7827fa1e1e995a72a60c3a6fa00f5b82fead
2177a596b2b041d9073df78d98d34e96b5a17c82ae3035bff89ddb890a0d06b2
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2e791cea0b4e689b8d862850ce773d23b07402255ace1c27e1a55e90cccd88f7
3091b6187cdf72d32615fd3df8c882e3cf6ca0f3e8b010d5f4f937ab2d619d94
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de
32707266dd68e7dd9d370a689c30ccc96361d30688dd37a22ddc578d9a930b95
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
39f73478283b96045ddddd09312d292053b99f02a3ecb14d2448334dce1b42e4
3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a
4dd6c09ddcb0e53a6290cc1df35224856073ba5f89d4134bd7c69e4fd9c6f515
4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628
58935760b2de8b3b6f698c14a28e3f86f69fc28764d2c02217facf7c4503f1e4
5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5cd804ec7036cddeb6403cd02cb908ebc248fe66e865dfc205df718463e3167c
5cde53806b876fdc810c50cf9564e5bf7a765cb6ab11681581b5e3162aa27f99
5fb46ad88af0181f8aa600691dadedc2d6dd1946603b69bc36385f68efdd01a3
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
61bdf8263399930987db53ce794ca3e2b51474fe5a6680a51eb9198fe032b9dd
63896532a7015ab5b7288359c02124980a5075e9267f0ba3fbfc7c3f5038b478
757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a
779651bc146d489786b9b4ab590d2784547448e4b85cf1bb9036b31e404d1a37
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8
82e4da2f6b37cb149745e150c5a68ef8535de0ce33704ea2c002c159b4760fe9
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
89f7d91eed427a69a989c9c77830d78a3758b5350fed0d8cb0d48ff25509c535
93d980ad435b662fb84e90a74983dcbb7705ccb06a14b2e9285528269861c122
9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd
9e3a9103c80346b1b39bea3de46f44a462b3f594fa45e7206252bc41d7e3e855
a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9
a50e47b011c842574eb42710c3b99650a6298701eb3de31109ad4cc52c636d4b
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
ab48f62299666780204b364453d95ac88ce57d2b811cab859d5dd05a35c5527a
ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5
aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88
af791735e8981444685cb725a0d68f447d27e58cd2a3aaac06d36edd1ffe661b
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
bad322c7b8f6fde37d48c8fac18bb81383eae6b42c2e4e170712ca3b1e39cfcc
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
c3f5dba2736798b2245d9497cc07995d3381b7b6f19dd3306a6e6075162105b8
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dde2a7cd4331f78a4b35dca9aa2e716fc3d0c83ba0f855f0812cbfae4a27a805
ddeec9dced8be575598e18285dac68896a44a1a39645c772ec6bebd284384067
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e68ee99300a311a6c4448d6567980cb3e60474453c4738d25ee5725211a57dbf
e805e9bb73863ab80d06660d97d22c961d3d7795f1399739b17ed739a5ea6677
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f08cea88c54a644c35abf8c3b33f3d997ff5bd673b940936f82bb80fcb37b6e2
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c
f329a255f4defd28c27a450fa767584c408d995966533ef9307434d4d7bcfbac
f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0