urlscan.io logo urlscan.io
SecurityTrails logo

www.fortinet.com Open in urlscan Pro
3.91.211.14  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6...
Effective URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Submission: On February 25 via api from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 65 IPs in 3 countries across 52 domains to perform 155 HTTP transactions. The main IP is 3.91.211.14, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 107155.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 13th 2021. Valid for: a year.
This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 142.0.160.14 7160 (NETDYNAMICS)
9 3.91.211.14 14618 (AMAZON-AES)
6 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
19 2600:141b:e80... 20940 (AKAMAI-ASN1)
2 5 35.162.68.238 16509 (AMAZON-02)
1 23.62.213.74 16625 (AKAMAI-AS)
3 104.123.161.196 16625 (AKAMAI-AS)
1 23.195.108.126 16625 (AKAMAI-AS)
1 4 2620:1ec:c11:... 8068 (MICROSOFT...)
1 68.67.179.166 29990 (ASN-APPNEX)
2 70.42.32.223 22075 (AS-OUTBRAIN)
2 54.208.50.252 14618 (AMAZON-AES)
8 23.59.105.202 16625 (AKAMAI-AS)
1 23.62.213.139 16625 (AKAMAI-AS)
1 195.181.168.47 60068 (CDN77 ^_^)
4 40.76.174.66 8075 (MICROSOFT...)
1 2 20.36.253.92 8075 (MICROSOFT...)
1 13.225.230.39 16509 (AMAZON-02)
1 13.225.230.103 16509 (AMAZON-02)
1 2 54.154.189.86 16509 (AMAZON-02)
8 2607:f8b0:400... 15169 (GOOGLE)
1 52.88.252.250 16509 (AMAZON-02)
3 54.212.155.93 16509 (AMAZON-02)
1 1 50.16.69.23 14618 (AMAZON-AES)
2 2607:f8b0:400... 15169 (GOOGLE)
2 37.19.206.70 60068 (CDN77 ^_^)
1 13.225.230.126 16509 (AMAZON-02)
1 13.225.230.122 16509 (AMAZON-02)
1 96.45.36.159 40934 (FORTINET)
1 34.251.139.24 16509 (AMAZON-02)
2 8 2600:9000:21e... 16509 (AMAZON-02)
2 2600:141b:13:... 20940 (AKAMAI-ASN1)
2 6 52.21.103.83 14618 (AMAZON-AES)
1 146.75.28.157 54113 (FASTLY)
1 54.69.255.140 16509 (AMAZON-02)
3 2a03:2880:f01... 32934 (FACEBOOK)
1 3 142.250.80.38 15169 (GOOGLE)
1 142.250.65.162 15169 (GOOGLE)
3 104.244.42.3 13414 (TWITTER)
3 104.244.42.69 13414 (TWITTER)
6 6 2620:1ec:21::14 8068 (MICROSOFT...)
3 3 108.174.10.24 14413 (LINKEDIN)
3 6 104.18.102.194 13335 (CLOUDFLAR...)
4 2607:f8b0:400... 15169 (GOOGLE)
14 16 3.208.223.190 14618 (AMAZON-AES)
3 2a03:2880:f11... 32934 (FACEBOOK)
1 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
8 9 52.223.40.198 16509 (AMAZON-02)
2 2 54.89.1.168 14618 (AMAZON-AES)
2 3 54.156.26.12 14618 (AMAZON-AES)
1 1 2607:f8b0:400... 15169 (GOOGLE)
1 2 23.62.212.240 16625 (AKAMAI-AS)
1 2 69.173.151.100 26667 (RUBICONPR...)
2 2 52.7.36.46 14618 (AMAZON-AES)
1 2 3.218.90.66 14618 (AMAZON-AES)
1 70.42.32.31 13789 (INTERNAP-...)
1 8.28.7.83 62713 (AS-PUBMATIC)
1 2001:4998:14:... 14777 (YAHOO)
1 141.226.224.48 200478 (TABOOLA-AS)
1 2 35.71.139.29 16509 (AMAZON-02)
1 2 35.211.178.172 19527 (GOOGLE-2)
2 3 68.67.160.114 29990 (ASN-APPNEX)
2 3 35.190.60.146 15169 (GOOGLE)
2 2 107.178.254.65 15169 (GOOGLE)
3 3 142.250.80.34 15169 (GOOGLE)
1 1 34.98.67.3 15169 (GOOGLE)
1 2 34.98.64.218 15169 (GOOGLE)
2 52.89.99.220 16509 (AMAZON-02)
1 34.212.4.35 16509 (AMAZON-02)
1 44.237.157.168 16509 (AMAZON-02)
1 1 23.200.173.135 16625 (AKAMAI-AS)
155 65
1    142.0.160.14 (United States)

ASN7160 (NETDYNAMICS, US)
apps.global.fortinet.com
9    3.91.211.14 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-91-211-14.compute-1.amazonaws.com
www.fortinet.com
6    2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.cookielaw.org
1    2606:4700:10::6814:b844 (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
19    2600:141b:e800:1192::1e80 (Piscataway, United States)

ASN20940 (AKAMAI-ASN1, NL)
assets.adobedtm.com
5    35.162.68.238 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-162-68-238.us-west-2.compute.amazonaws.com
dpm.demdex.net
1    23.62.213.74 (Atlanta, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-62-213-74.deploy.static.akamaitechnologies.com
amplify.outbrain.com
3    104.123.161.196 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-123-161-196.deploy.static.akamaitechnologies.com
j.6sc.co
c.6sc.co
1    23.195.108.126 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-195-108-126.deploy.static.akamaitechnologies.com
s7.addthis.com
4    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
c.bing.com
1    68.67.179.166 (Secaucus, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
secure.adnxs.com
2    70.42.32.223 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
tr.outbrain.com
2    54.208.50.252 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-208-50-252.compute-1.amazonaws.com
epsilon.6sense.com
8    23.59.105.202 (Atlanta, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-59-105-202.deploy.static.akamaitechnologies.com
b.6sc.co
1    23.62.213.139 (Atlanta, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-62-213-139.deploy.static.akamaitechnologies.com
z.moatads.com
1    195.181.168.47 (United States)

ASN60068 (CDN77 ^_^, GB)
PTR: edge-742.bunnyinfra.net
a.opmnstr.com
4    40.76.174.66 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
d.clarity.ms
2    20.36.253.92 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.clarity.ms
1    13.225.230.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-230-39.jfk51.r.cloudfront.net
api.omappapi.com
1    13.225.230.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-230-103.jfk51.r.cloudfront.net
static.hotjar.com
2    54.154.189.86 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-189-86.eu-west-1.compute.amazonaws.com
argusplatform.com
www.argusplatform.com
8    2607:f8b0:4006:80e::2008 (Queens, United States)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    52.88.252.250 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-88-252-250.us-west-2.compute.amazonaws.com
fortinet.demdex.net
3    54.212.155.93 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-212-155-93.us-west-2.compute.amazonaws.com
metrics.fortinet.com
1    50.16.69.23 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-69-23.compute-1.amazonaws.com
cm.everesttech.net
2    2607:f8b0:4006:820::200e (Queens, United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    37.19.206.70 (United States)

ASN60068 (CDN77 ^_^, GB)
PTR: unn-37-19-206-70.datapacket.com
a.omappapi.com
1    13.225.230.126 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-230-126.jfk51.r.cloudfront.net
script.hotjar.com
1    13.225.230.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-230-122.jfk51.r.cloudfront.net
vars.hotjar.com
1    96.45.36.159 (Santa Clara, United States)

ASN40934 (FORTINET, US)
site.fortinet.com
1    34.251.139.24 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-139-24.eu-west-1.compute.amazonaws.com
pixels.argusplatform.com
8    2600:9000:21ec:1a00:6:9280:1080:93a1 (United States)

ASN16509 (AMAZON-02, US)
s.adroll.com
2    2600:141b:13::17d7:825a (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
6    52.21.103.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-103-83.compute-1.amazonaws.com
ml314.com
1    146.75.28.157 (Ashburn, United States)

ASN54113 (FASTLY, US)
static.ads-twitter.com
1    54.69.255.140 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-69-255-140.us-west-2.compute.amazonaws.com
dx.mountain.com
3    2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
connect.facebook.net
3    142.250.80.38 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f6.1e100.net
10104846.fls.doubleclick.net
1    142.250.65.162 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f2.1e100.net
www.googleadservices.com
3    104.244.42.3 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
3    104.244.42.69 (United States)

ASN13414 (TWITTER, US)
t.co
6    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
3    108.174.10.24 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-24.fwd.linkedin.com
px4.ads.linkedin.com
6    104.18.102.194 (None, )

ASN13335 (CLOUDFLARENET, US)
p.adsymptotic.com
4    2607:f8b0:4006:824::2002 (Queens, United States)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
16    3.208.223.190 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-208-223-190.compute-1.amazonaws.com
d.adroll.com
3    2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2607:f8b0:4006:80d::2002 (Queens, United States)

ASN15169 (GOOGLE, US)
adservice.google.com
4    2607:f8b0:4006:80d::2004 (Queens, United States)

ASN15169 (GOOGLE, US)
www.google.com
4    2607:f8b0:4006:80e::2003 (Queens, United States)

ASN15169 (GOOGLE, US)
www.google.ca
9    52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org
insight.adsrvr.org
2    54.89.1.168 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-89-1-168.compute-1.amazonaws.com
sync.crwdcntrl.net
3    54.156.26.12 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-156-26-12.compute-1.amazonaws.com
ps.eyeota.net
1    2607:f8b0:4006:80c::2002 (Queens, United States)

ASN15169 (GOOGLE, US)
adservice.google.ca
2    23.62.212.240 (Atlanta, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-62-212-240.deploy.static.akamaitechnologies.com
dsum-sec.casalemedia.com
2    69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
2    52.7.36.46 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-7-36-46.compute-1.amazonaws.com
pixel.advertising.com
2    3.218.90.66 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-218-90-66.compute-1.amazonaws.com
ups.analytics.yahoo.com
1    70.42.32.31 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com
sync.outbrain.com
1    8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
1    2001:4998:14:800::1001 (United States)

ASN14777 (YAHOO, US)
ads.yahoo.com
1    141.226.224.48 (United States)

ASN200478 (TABOOLA-AS, IL)
sync.taboola.com
2    35.71.139.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com
eb2.3lift.com
2    35.211.178.172 (North Charleston, United States)

ASN19527 (GOOGLE-2, US)
PTR: 172.178.211.35.bc.googleusercontent.com
x.bidswitch.net
3    68.67.160.114 (Brooklyn, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
3    35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
idsync.rlcdn.com
2    107.178.254.65 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com
pippio.com
3    142.250.80.34 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f2.1e100.net
cm.g.doubleclick.net
1    34.98.67.3 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 3.67.98.34.bc.googleusercontent.com
tags.rd.linksynergy.com
2    34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com
us-u.openx.net
2    52.89.99.220 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-89-99-220.us-west-2.compute.amazonaws.com
px.mountain.com
1    34.212.4.35 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-212-4-35.us-west-2.compute.amazonaws.com
gs.mountain.com
1    44.237.157.168 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-237-157-168.us-west-2.compute.amazonaws.com
px.steelhousemedia.com
1    23.200.173.135 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-200-173-135.deploy.static.akamaitechnologies.com
tags.bluekai.com
Apex Domain
Subdomains		 Transfer
24 adroll.com
s.adroll.com — Cisco Umbrella Rank: 2263
d.adroll.com — Cisco Umbrella Rank: 1329
36 KB
19 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 505
103 KB
14 fortinet.com
apps.global.fortinet.com — Cisco Umbrella Rank: 626205
www.fortinet.com — Cisco Umbrella Rank: 107155
metrics.fortinet.com — Cisco Umbrella Rank: 336278
site.fortinet.com — Cisco Umbrella Rank: 331435
713 KB
11 6sc.co
j.6sc.co — Cisco Umbrella Rank: 7147
c.6sc.co — Cisco Umbrella Rank: 10540
b.6sc.co — Cisco Umbrella Rank: 5621
25 KB
10 doubleclick.net
10104846.fls.doubleclick.net — Cisco Umbrella Rank: 405141
googleads.g.doubleclick.net — Cisco Umbrella Rank: 37
cm.g.doubleclick.net — Cisco Umbrella Rank: 175
8 KB
9 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 295
insight.adsrvr.org — Cisco Umbrella Rank: 607
5 KB
9 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 439
www.linkedin.com — Cisco Umbrella Rank: 602
px4.ads.linkedin.com — Cisco Umbrella Rank: 5087
6 KB
8 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 50
314 KB
6 adsymptotic.com
p.adsymptotic.com — Cisco Umbrella Rank: 497
1 KB
6 ml314.com
ml314.com — Cisco Umbrella Rank: 1357
16 KB
6 clarity.ms
d.clarity.ms — Cisco Umbrella Rank: 2006
c.clarity.ms — Cisco Umbrella Rank: 693
24 KB
6 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 187
fortinet.demdex.net — Cisco Umbrella Rank: 323417
8 KB
6 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 443
116 KB
5 google.ca
www.google.ca — Cisco Umbrella Rank: 8810
adservice.google.ca — Cisco Umbrella Rank: 12901
2 KB
5 google.com
adservice.google.com — Cisco Umbrella Rank: 59
www.google.com — Cisco Umbrella Rank: 2
2 KB
4 mountain.com
dx.mountain.com — Cisco Umbrella Rank: 10797
px.mountain.com — Cisco Umbrella Rank: 10639
gs.mountain.com — Cisco Umbrella Rank: 16036
7 KB
4 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 350
ib.adnxs.com — Cisco Umbrella Rank: 210
4 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 331
c.bing.com — Cisco Umbrella Rank: 212
13 KB
4 outbrain.com
amplify.outbrain.com — Cisco Umbrella Rank: 2190
tr.outbrain.com — Cisco Umbrella Rank: 1993
sync.outbrain.com — Cisco Umbrella Rank: 717
4 KB
3 rlcdn.com
idsync.rlcdn.com — Cisco Umbrella Rank: 283
562 B
3 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 269
ads.yahoo.com — Cisco Umbrella Rank: 835
868 B
3 eyeota.net
ps.eyeota.net — Cisco Umbrella Rank: 845
2 KB
3 facebook.com
www.facebook.com — Cisco Umbrella Rank: 97
514 B
3 t.co
t.co — Cisco Umbrella Rank: 456
727 B
3 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 468
906 B
3 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 126
200 KB
3 argusplatform.com
argusplatform.com — Cisco Umbrella Rank: 196114
www.argusplatform.com — Cisco Umbrella Rank: 223854
pixels.argusplatform.com — Cisco Umbrella Rank: 286603
3 KB
3 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 574
script.hotjar.com — Cisco Umbrella Rank: 726
vars.hotjar.com — Cisco Umbrella Rank: 809
66 KB
3 omappapi.com
api.omappapi.com — Cisco Umbrella Rank: 4634
a.omappapi.com — Cisco Umbrella Rank: 4876
27 KB
2 openx.net
us-u.openx.net — Cisco Umbrella Rank: 322
390 B
2 pippio.com
pippio.com — Cisco Umbrella Rank: 692
848 B
2 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 265
1 KB
2 3lift.com
eb2.3lift.com — Cisco Umbrella Rank: 356
739 B
2 advertising.com
pixel.advertising.com — Cisco Umbrella Rank: 307
817 B
2 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 288
2 KB
2 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 488
2 KB
2 crwdcntrl.net
sync.crwdcntrl.net — Cisco Umbrella Rank: 662
862 B
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 830
3 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 31
20 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 12137
655 B
1 bluekai.com
tags.bluekai.com — Cisco Umbrella Rank: 425
845 B
1 steelhousemedia.com
px.steelhousemedia.com — Cisco Umbrella Rank: 6841
303 B
1 linksynergy.com
tags.rd.linksynergy.com — Cisco Umbrella Rank: 3850
357 B
1 taboola.com
sync.taboola.com — Cisco Umbrella Rank: 725
222 B
1 pubmatic.com
image2.pubmatic.com — Cisco Umbrella Rank: 752
588 B
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 99
15 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 539
6 KB
1 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 881
517 B
1 opmnstr.com
a.opmnstr.com — Cisco Umbrella Rank: 15504
57 KB
1 moatads.com
z.moatads.com — Cisco Umbrella Rank: 330
1 KB
1 addthis.com
s7.addthis.com — Cisco Umbrella Rank: 1324
114 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 709
434 B
155 52
Domain Requested by
19 assets.adobedtm.com cdn.cookielaw.org
assets.adobedtm.com
16 d.adroll.com 14 redirects s.adroll.com
9 www.fortinet.com apps.global.fortinet.com
www.fortinet.com
8 match.adsrvr.org 7 redirects
8 s.adroll.com 2 redirects apps.global.fortinet.com
s.adroll.com
d.adroll.com
8 www.googletagmanager.com apps.global.fortinet.com
www.googletagmanager.com
assets.adobedtm.com
8 b.6sc.co www.fortinet.com
6 p.adsymptotic.com 3 redirects 10104846.fls.doubleclick.net
6 ml314.com 2 redirects apps.global.fortinet.com
ml314.com
6 cdn.cookielaw.org www.fortinet.com
cdn.cookielaw.org
5 px.ads.linkedin.com 5 redirects
5 dpm.demdex.net 2 redirects www.fortinet.com
4 www.google.ca
4 www.google.com
4 googleads.g.doubleclick.net www.googleadservices.com
4 d.clarity.ms bat.bing.com
d.clarity.ms
3 cm.g.doubleclick.net 3 redirects
3 idsync.rlcdn.com 2 redirects
3 ib.adnxs.com 2 redirects
3 ps.eyeota.net 2 redirects
3 www.facebook.com
3 px4.ads.linkedin.com 3 redirects
3 t.co
3 analytics.twitter.com static.ads-twitter.com
3 10104846.fls.doubleclick.net 1 redirects assets.adobedtm.com
adservice.google.com
3 connect.facebook.net apps.global.fortinet.com
connect.facebook.net
3 metrics.fortinet.com assets.adobedtm.com
www.fortinet.com
3 bat.bing.com assets.adobedtm.com
bat.bing.com
www.fortinet.com
2 px.mountain.com dx.mountain.com
apps.global.fortinet.com
2 us-u.openx.net 1 redirects
2 pippio.com 2 redirects
2 x.bidswitch.net 1 redirects
2 eb2.3lift.com 1 redirects
2 ups.analytics.yahoo.com 1 redirects
2 pixel.advertising.com 2 redirects
2 pixel.rubiconproject.com 1 redirects
2 dsum-sec.casalemedia.com 1 redirects
2 sync.crwdcntrl.net 2 redirects
2 snap.licdn.com apps.global.fortinet.com
snap.licdn.com
2 a.omappapi.com a.opmnstr.com
www.fortinet.com
2 www.google-analytics.com a.opmnstr.com
www.google-analytics.com
2 c.clarity.ms 1 redirects www.fortinet.com
2 epsilon.6sense.com j.6sc.co
2 tr.outbrain.com amplify.outbrain.com
www.fortinet.com
2 j.6sc.co apps.global.fortinet.com
1 tags.bluekai.com 1 redirects
1 insight.adsrvr.org 1 redirects
1 px.steelhousemedia.com
1 gs.mountain.com apps.global.fortinet.com
1 tags.rd.linksynergy.com 1 redirects
1 sync.taboola.com
1 ads.yahoo.com
1 image2.pubmatic.com
1 sync.outbrain.com
1 adservice.google.ca 1 redirects
1 adservice.google.com 10104846.fls.doubleclick.net
1 www.linkedin.com 1 redirects
1 www.googleadservices.com www.googletagmanager.com
1 dx.mountain.com apps.global.fortinet.com
1 static.ads-twitter.com apps.global.fortinet.com
1 pixels.argusplatform.com www.fortinet.com
1 site.fortinet.com www.fortinet.com
1 vars.hotjar.com static.hotjar.com
1 script.hotjar.com static.hotjar.com
1 cm.everesttech.net 1 redirects
1 fortinet.demdex.net assets.adobedtm.com
1 www.argusplatform.com www.fortinet.com
1 argusplatform.com 1 redirects
1 static.hotjar.com apps.global.fortinet.com
1 api.omappapi.com a.opmnstr.com
1 c.bing.com 1 redirects
1 a.opmnstr.com assets.adobedtm.com
1 z.moatads.com s7.addthis.com
1 c.6sc.co j.6sc.co
1 secure.adnxs.com j.6sc.co
1 s7.addthis.com assets.adobedtm.com
1 amplify.outbrain.com apps.global.fortinet.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 apps.global.fortinet.com
155 79
Subject Issuer Validity Valid
global.fortinet.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-16 -
2022-07-21		 a year crt.sh
*.fortinet.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-13 -
2022-04-13		 a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3		 2021-06-01 -
2022-05-31		 a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3		 2022-01-12 -
2023-01-12		 a year crt.sh
assets.adobedtm.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-10 -
2022-09-10		 a year crt.sh
*.outbrain.com
DigiCert SHA2 Secure Server CA		 2021-05-25 -
2022-06-01		 a year crt.sh
*.6sc.co
DigiCert SHA2 Secure Server CA		 2021-03-09 -
2022-03-16		 a year crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2021-04-25 -
2022-04-27		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 01		 2021-12-22 -
2022-06-22		 6 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2022-02-11 -
2023-03-14		 a year crt.sh
*.6sense.com
Amazon		 2021-06-09 -
2022-07-08		 a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2021-11-27 -
2022-11-29		 a year crt.sh
a.opmnstr.com
R3		 2022-02-07 -
2022-05-08		 3 months crt.sh
a.clarity.ms
Microsoft RSA TLS CA 01		 2021-07-27 -
2022-07-27		 a year crt.sh
api.opmnstr.com
Amazon		 2022-02-09 -
2023-03-10		 a year crt.sh
*.hotjar.com
Amazon		 2021-11-25 -
2022-12-23		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-19 -
2022-11-19		 a year crt.sh
a.omappapi.com
R3		 2022-02-07 -
2022-05-08		 3 months crt.sh
pixels.argusplatform.com
R3		 2022-02-11 -
2022-05-12		 3 months crt.sh
s.adroll.com
Amazon		 2021-08-02 -
2022-08-31		 a year crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA		 2021-07-15 -
2022-07-20		 a year crt.sh
*.ml314.com
Amazon		 2021-12-17 -
2023-01-14		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-21 -
2022-07-26		 a year crt.sh
*.mountain.com
Go Daddy Secure Certificate Authority - G2		 2021-05-20 -
2022-06-21		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-12-05 -
2022-03-05		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
www.googleadservices.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-22 -
2023-02-22		 a year crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-22 -
2023-02-22		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
adroll.mgr.consensu.org
Amazon		 2021-09-10 -
2022-10-09		 a year crt.sh
*.google.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
*.google.ca
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh

This page contains 7 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Frame ID: 7406E8AE2B58BC10D7914646300D9181
Requests: 150 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: C66D45B0F5A680A31D57AFE741113624
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-acca23410e696f2ca3087d947271c3d0.html
Frame ID: 0B8ABB3C43EC022909A9CD948499BD2E
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786
Frame ID: 16AA5BDF556F01136FCEEBBB52638233
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786;~oref=https://www.fortinet.com/
Frame ID: B68BB6E97D39BD9D96C1A8BB6D6D56E8
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/ddm/fls/r/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786;~oref=https://www.fortinet.com/
Frame ID: 4C2D5E6DBFE5AEC76CD84004D044CD2C
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 2A0685D63C4B83E586153908E75408C1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Nobelium Returns to the Political World Stage | FortiGuard Labs Back ButtonFilter Button

Page URL History Show full URLs

  1. https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45e... Page URL
  2. https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc\.clientlibs/
Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com
Overall confidence: 100%
Detected patterns
  • addthis\.com/js/
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • moatads\.com
Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • tracker\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

155
Requests

82 %
HTTPS

23 %
IPv6

52
Domains

79
Subdomains

65
IPs

3
Countries

1897 kB
Transfer

4702 kB
Size

113
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218 Page URL
  2. https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20
  • https://dpm.demdex.net/id?d_visid_ver=5.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1645819902358 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=5.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1645819902358
Request Chain 42
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=82C91689BAAD41DC9B6E6A47B2DFFE03&RedC=c.clarity.ms&MXFR=30BF1B29015769981B8E0A7F055767F9 HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=82C91689BAAD41DC9B6E6A47B2DFFE03&MUID=0309D56B7F296E6E3B61C43D7E836FED
Request Chain 45
  • https://argusplatform.com/js/wid.tracker.js HTTP 301
  • https://www.argusplatform.com/js/wid.tracker.js
Request Chain 49
  • https://cm.everesttech.net/cm/dd?d_uuid=32320825144907041532078492508500204060 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Yhk3-gAAAHM3uQPl
Request Chain 88
  • https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786 HTTP 302
  • https://10104846.fls.doubleclick.net/activityi;dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786
Request Chain 90
  • https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 91
  • https://s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/fpconsent.js HTTP 302
  • https://s.adroll.com/j/pre/index.js
Request Chain 101
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1645819903645&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1645819903645&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26time%3D1645819903645%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fnobelium-returns-to-the-political-world-stage%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1645819903645&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1645819903645&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&cookiesTest=true&liSync=true&e_ipv6=AQIW_KSjXKdhcwAAAX8ygsBBvQhHSN2OmD-SLZP_BtNA-MxffCcIRuvyXg-FnGjwHjHPo2qk HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806 HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=3f02fde736ed7929b18690aaa1fad693
Request Chain 118
  • https://d.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pv=49226025165.526855&cookie=&adroll_s_ref=https%3A//apps.global.fortinet.com/&keyw= HTTP 302
  • https://s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/VGLVDYA6GRASZMUSTHUV5D.js
Request Chain 120
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
  • https://ml314.com/utsync.ashx?eid=53819&et=0&fp=6efcbacd-059a-41f4-ade0-df1ed7058974&gdpr=0&gdpr_consent=
Request Chain 121
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3625396256698794042 HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3625396256698794042 HTTP 302
  • https://ml314.com/csync.ashx?fp=ccd222cbcfd591bd250aee60c572d50c&eid=50146&person_id=3625396256698794042
Request Chain 122
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2NAjb7rZpI9w_GccQPQMFhDWbWOo7miVprMsEQ1e1L0o&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
  • https://ml314.com/csync.ashx?fp=2NAjb7rZpI9w_GccQPQMFhDWbWOo7miVprMsEQ1e1L0o&person_id=3625396256698794042&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil%26referrer_pid%3dr8hrb20 HTTP 302
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Request Chain 123
  • https://adservice.google.ca/ddm/fls/i/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786;~oref=https://www.fortinet.com/ HTTP 302
  • https://10104846.fls.doubleclick.net/ddm/fls/r/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786;~oref=https://www.fortinet.com/
Request Chain 126
  • https://px.ads.linkedin.com/collect/?pid=2148604&fmt=gif HTTP 302
  • https://px4.ads.linkedin.com/collect?pid=2148604&fmt=gif&e_ipv6=AQKGWj-ODQkXUQAAAX8ygr-zoTn2fLPVA-0wT8M0vXmJHBMQbuwwezRWWobZ_EQrAGxwOCFl HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806 HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=f48c8aeca073176c4c0dadd06a1ad252
Request Chain 127
  • https://d.adroll.com/cm/index/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&expiration=1677355903 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&expiration=1677355903&C=1
Request Chain 128
  • https://d.adroll.com/cm/n/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&expires=365
Request Chain 129
  • https://d.adroll.com/cm/onevideo/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://pixel.advertising.com/ups/55980/sync?uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
  • https://pixel.advertising.com/ups/55980/sync?uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/55980/sync?uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP26e99781-9677-11ec-b0b6-0aa04754be25 HTTP 302
  • https://ups.analytics.yahoo.com/ups/55980/sync?uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP26e99781-9677-11ec-b0b6-0aa04754be25&verify=true
Request Chain 130
  • https://d.adroll.com/cm/outbrain/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
Request Chain 131
  • https://d.adroll.com/cm/pubmatic/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Request Chain 132
  • https://d.adroll.com/cm/r/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Request Chain 133
  • https://d.adroll.com/cm/taboola/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
Request Chain 134
  • https://d.adroll.com/cm/triplelift/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://eb2.3lift.com/xuid?mid=4714&xuid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&dongle=c85e HTTP 302
  • https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=
Request Chain 135
  • https://d.adroll.com/cm/b/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
Request Chain 136
  • https://d.adroll.com/cm/x/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://ib.adnxs.com/setuid?entity=172&code=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
Request Chain 137
  • https://d.adroll.com/cm/l/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://idsync.rlcdn.com/377928.gif?partner_uid=5efecbec43b83ea17f137a72ff33182b HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CMiIFxIrCicIARDqIhogNWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmIQABoNCP_v5JAGEgUI6AcQAEIASgA HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=c3ac372baf877012b0a84f1140022bcdc6673c6ebf8988c7d0e914b6fd23990d791426b5417dce21&_=2 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBjM2FjMzcyYmFmODc3MDEyYjBhODRmMTE0MDAyMmJjZGM2NjczYzZlYmY4OTg4YzdkMGU5MTRiNmZkMjM5OTBkNzkxNDI2YjU0MTdkY2UyMRAAGgwIgPDkkAYSBAgCEABCAEoA HTTP 302
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBjM2FjMzcyYmFmODc3MDEyYjBhODRmMTE0MDAyMmJjZGM2NjczYzZlYmY4OTg4YzdkMGU5MTRiNmZkMjM5OTBkNzkxNDI2YjU0MTdkY2UyMRAAGgwIgPDkkAYSBAgCEABCAEoA&google_gid=CAESEFYNsKhmW4Ns_zjqef0vRi0&google_cver=1 HTTP 307
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
  • https://idsync.rlcdn.com/458249.gif?partner_uid=2816a7a3-0f9b-4521-9cfe-0c88284230c0
Request Chain 138
  • https://d.adroll.com/cm/o/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=5efecbec43b83ea17f137a72ff33182b HTTP 302
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=5efecbec43b83ea17f137a72ff33182b
Request Chain 139
  • https://d.adroll.com/cm/g/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&advertisable=7OBVBCAQE5FHDPFEAD5T4D&google_nid=adroll5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=Xv7L7EO4PqF_E3py_zMYKw HTTP 302
  • https://d.adroll.com/cm/g/in
Request Chain 143
  • https://px.ads.linkedin.com/collect/?pid=2159050&conversionId=6504418&fmt=gif HTTP 302
  • https://px4.ads.linkedin.com/collect?pid=2159050&conversionId=6504418&fmt=gif&e_ipv6=AQJ7HxLoxNx6uQAAAX8ygsB0jqEcVbxUpZDBQeoFb4rJLJBzqzVpnU9-89riWoGiBpgC2VrQ HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806 HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=62b6be551203d19bdb65cded38963028
Request Chain 148
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=270cfd43-9677-11ec-a8fb-9feab8c30f01&gdpr=&gdpr_consent= HTTP 302
  • https://px.steelhousemedia.com/tdsync?tdid=6efcbacd-059a-41f4-ade0-df1ed7058974&shguid=270cfd43-9677-11ec-a8fb-9feab8c30f01
Request Chain 149
  • https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=6efcbacd-059a-41f4-ade0-df1ed7058974&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=6efcbacd-059a-41f4-ade0-df1ed7058974&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=6efcbacd-059a-41f4-ade0-df1ed7058974 HTTP 302
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=1625538908390479308&ttd_tdid=6efcbacd-059a-41f4-ade0-df1ed7058974 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NmVmY2JhY2QtMDU5YS00MWY0LWFkZTAtZGYxZWQ3MDU4OTc0&gdpr=0&gdpr_consent=&ttd_tdid=6efcbacd-059a-41f4-ade0-df1ed7058974 HTTP 302
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=6efcbacd-059a-41f4-ade0-df1ed7058974&google_gid=CAESEOR9XvCooqb9uhhyDIu2hR4&google_cver=1 HTTP 302
  • https://tags.bluekai.com/site/5386?id=6efcbacd-059a-41f4-ade0-df1ed7058974&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai

155 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
bfs
apps.global.fortinet.com/e/ 		203 B
872 B 		Document
General
Check archive.org
Download Go to
Full URL
https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.0.160.14 , United States, ASN7160 (NETDYNAMICS, US),
Reverse DNS
Software
/
Resource Hash
a5fcefaba919e6115c4d7ed76d1ea94529a8ca0c00e555ce93b075b290df99ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Cache-Control
no-store
Pragma
no-cache
Transfer-Encoding
chunked
Content-Type
text/html;charset=UTF-8
Content-Encoding
identity
Expires
-1
X-Robots-Tag
noindex, nofollow
X-Xss-Protection
1; mode=block
Access-Control-Allow-Origin
*
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
X-Content-Type-Options
nosniff
Date
Fri, 25 Feb 2022 20:11:40 GMT
Primary Request nobelium-returns-to-the-political-world-stage
www.fortinet.com/blog/threat-research/ 		43 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.91.211.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-91-211-14.compute-1.amazonaws.com
Software
Apache /
Resource Hash
7ec050c22e54c97b896f3196057dd010e45c580fe6ca44c91e2e3a513730494f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://apps.global.fortinet.com/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=600, public
Content-Encoding
gzip
Content-Type
text/html;charset=utf-8
Date
Fri, 25 Feb 2022 20:11:41 GMT
ETag
"ac5f-5d8dc53fcdc76-gzip"
Last-Modified
Fri, 25 Feb 2022 19:01:37 GMT
Server
Apache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding,User-Agent
X-Content-Type-Options
nosniff
X-Dispatcher
dispatcher1uswest1
X-Frame-Options
SAMEORIGIN
X-Vhost
publish
Content-Length
14273
Connection
keep-alive
X-XSS-Protection
1; mode=block
clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		216 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.91.211.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-91-211-14.compute-1.amazonaws.com
Software
Apache /
Resource Hash
cc6d6ba4009e5b68c04afbbc9e0a8228a264e32047c2658a6d55d122072a8295
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Fri, 25 Feb 2022 20:11:41 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Vhost
publish
Connection
keep-alive
Vary
Accept-Encoding,User-Agent
Content-Length
26964
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 05 Oct 2021 20:12:10 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"3616e-5cda0a4fc1a80-gzip"
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
text/css;charset=utf-8
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
134482ec36c8980c2c7a3f2454c76546abcd612c9ae596d011251a7cd1d0fcbb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 25 Feb 2022 20:11:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
zadN1tnUFXNBOXe6vsJdDg==
age
11233
vary
Accept-Encoding
content-length
6456
x-ms-lease-status
unlocked
last-modified
Thu, 24 Feb 2022 07:16:58 GMT
server
cloudflare
etag
0x8D9F765A5099F89
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
570fb7f0-201e-0128-6d4f-29e90c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6e339590ef194bd1-YUL
fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 		32 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.91.211.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-91-211-14.compute-1.amazonaws.com
Software
Apache /
Resource Hash
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Fri, 25 Feb 2022 20:11:41 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Vhost
publish
Content-Disposition
attachment; filename="fortinet-logo-white.svg"
Connection
keep-alive
Vary
Accept-Encoding,User-Agent
Content-Length
1998
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 22 Feb 2018 23:16:01 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"7ebb-565d53a1d6e40-gzip"
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/svg+xml
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
clientlib-base.min.js
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		150 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.91.211.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-91-211-14.compute-1.amazonaws.com
Software
Apache /
Resource Hash
1e1a42cb75ebd81eb31850e485ef4c6e3667a45f57f778f249bca1f2852a97e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Fri, 25 Feb 2022 20:11:41 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Vhost
publish
Connection
keep-alive
Vary
Accept-Encoding,User-Agent
Content-Length
70015
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 14 Jan 2021 20:20:55 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"25644-5b8e1fe2bf7c0-gzip"
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
application/javascript;charset=utf-8
Cache-Control
max-age=684000, public
Accept-Ranges
bytes
f85f39fc-d7aa-467a-b762-fbb722748016.json
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a334f368b502d68bcaafb174022cfe21775f1744f0a1cd520d0c57d094a8e66a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 25 Feb 2022 20:11:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
ypNp2Paf3c+p42YUXiXMnA==
age
13846
vary
Accept-Encoding
content-length
1413
x-ms-lease-status
unlocked
last-modified
Fri, 12 Feb 2021 00:26:33 GMT
server
cloudflare
etag
0x8D8CEECD9FE5833
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
d57e5650-b01e-00c7-6a15-b6a427000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6e339591b8194bca-YUL
expires
Sat, 26 Feb 2022 00:11:41 GMT
truncated
/ 		71 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/png
nobelium-political-stage-hero.jpeg
www.fortinet.com/content/dam/fortinet-blog/article-images/ 		184 KB
185 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/nobelium-political-stage-hero.jpeg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.91.211.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-91-211-14.compute-1.amazonaws.com
Software
Apache /
Resource Hash
9213e89897982f211a9055c3337ac2f00726e2d64489ea99f5173fb572a946d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Fri, 25 Feb 2022 20:11:41 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 24 Feb 2022 19:14:44 GMT
Server
Apache
ETag
"2e0e9-5d8c8650d9100"
X-Vhost
publish
X-Frame-Options
SAMEORIGIN
Connection
keep-alive
Content-Type
image/jpeg
Cache-Control
max-age=684000, public
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Content-Length
188649
X-XSS-Protection
1; mode=block
fglabs-ransomware-destructive-thumb.jpeg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 		126 KB
127 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/fglabs-ransomware-destructive-thumb.jpeg.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.91.211.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-91-211-14.compute-1.amazonaws.com
Software
Apache /
Resource Hash
11816a0873ff77d255f6be4dceaede153ca3a3d4990100554dc1c5f61a934a06
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Fri, 25 Feb 2022 20:11:42 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 15 Feb 2022 23:08:30 GMT
Server
Apache
ETag
"1f9f3-5d8169c7ef780"
X-Vhost
publish
X-Frame-Options
SAMEORIGIN
Connection
keep-alive
Content-Type
image/png
Cache-Control
max-age=684000, public
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Content-Length
129523
X-XSS-Protection
1; mode=block
social-driveguard-blog-020222_thumb.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 		103 KB
103 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/social-driveguard-blog-020222_thumb.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.91.211.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-91-211-14.compute-1.amazonaws.com
Software
Apache /
Resource Hash
b399694d43775ea7757674996d3a5f466ea7afbe492ff90617595a12dadc4b58
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Fri, 25 Feb 2022 20:11:41 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 03 Feb 2022 00:49:43 GMT
Server
Apache
ETag
"19b15-5d7128289b7c0"
X-Vhost
publish
X-Frame-Options
SAMEORIGIN
Connection
keep-alive
Content-Type
image/png
Cache-Control
max-age=684000, public
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Content-Length
105237
X-XSS-Protection
1; mode=block
NFT-lure-bitrat-blog-thumb.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 		145 KB
146 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/NFT-lure-bitrat-blog-thumb.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.91.211.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-91-211-14.compute-1.amazonaws.com
Software
Apache /
Resource Hash
7a845344c57ceb50d3a4656048eac82130caded56be394b3d5bea83516775ac4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Dispatcher
dispatcher1uswest1
Date
Fri, 25 Feb 2022 20:11:42 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 08 Feb 2022 18:29:22 GMT
Server
Apache
ETag
"2456c-5d785e5592480"
X-Vhost
publish
X-Frame-Options
SAMEORIGIN
Connection
keep-alive
Content-Type
image/png
Cache-Control
max-age=684000, public
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Content-Length
148844
X-XSS-Protection
1; mode=block
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 		157 B
434 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74b1612d1cb16d432cfd6542a7efe8f9297f1197025e044b9e0d9fa8e54befab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.fortinet.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:41 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6e3395924b54ca5f-YUL
access-control-allow-headers
Content-Type
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.10.0/ 		356 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 25 Feb 2022 20:11:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Bh9exWOPGIwRshWljrtlEw==
age
11225016
vary
Accept-Encoding
content-length
79698
x-ms-lease-status
unlocked
last-modified
Thu, 03 Dec 2020 02:43:00 GMT
server
cloudflare
etag
0x8D89735260901BC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
28487d86-701e-0130-706c-c4c499000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6e339592797f4bd1-YUL
en.json
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/21f81f97-7d7e-4ec0-a244-66254c286eb2/ 		62 KB
14 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/21f81f97-7d7e-4ec0-a244-66254c286eb2/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ffb8f3aec546bb06d1c4635ba17d29bf85c06c952e153034dae313250cbb829
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 25 Feb 2022 20:11:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
N/aNhuT6TciP7knaMxQGgw==
age
2505
vary
Accept-Encoding
content-length
14408
x-ms-lease-status
unlocked
last-modified
Fri, 12 Feb 2021 00:26:38 GMT
server
cloudflare
etag
0x8D8CEECDCAD7A99
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
2f733433-c01e-0166-6215-b62ce9000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6e339592b96d4bca-YUL
expires
Sat, 26 Feb 2022 00:11:41 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 		13 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 25 Feb 2022 20:11:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
W9e0YobmEbvdB0V9OmpQkw==
age
11436
vary
Accept-Encoding
content-length
3329
x-ms-lease-status
unlocked
last-modified
Thu, 03 Dec 2020 02:42:50 GMT
server
cloudflare
etag
0x8D89735209A34D6
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
a9d5ccba-301e-011e-7f6c-c4445e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6e339592e99d4bca-YUL
otPcTab.json
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 		45 KB
12 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 25 Feb 2022 20:11:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
zNsRoM1FEmsEgJoYMCNTng==
age
11224780
vary
Accept-Encoding
content-length
11755
x-ms-lease-status
unlocked
last-modified
Thu, 03 Dec 2020 02:42:53 GMT
server
cloudflare
etag
0x8D897352245C4EA
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
077a373d-a01e-00f1-7a6c-c40975000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6e339592e99e4bca-YUL
img1.png
www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage/_jcr_content/root/responsivegrid/image.img.png/1645729548791/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage/_jcr_content/root/responsivegrid/image.img.png/1645729548791/img1.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.91.211.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-91-211-14.compute-1.amazonaws.com
Software
Apache /
Resource Hash
5131187204ce9efe08b945d15633d7d418fd692999f824f9a55524aa95559fea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Dispatcher
dispatcher2uswest1
Date
Fri, 25 Feb 2022 20:11:42 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 24 Feb 2022 19:05:48 GMT
Server
Apache
ETag
"8f2f-5d8c8451adb00"
X-Vhost
publish
X-Frame-Options
SAMEORIGIN
Connection
keep-alive
Content-Type
image/png
Cache-Control
max-age=684000, public
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Content-Length
36655
X-XSS-Protection
1; mode=block
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		817 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
assets.adobedtm.com/ 		343 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
bbf4d111477ba98c1f74a84ec0a2b7d5712f35bd6fbe2b388f5cb3f2f6c7a7d1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:17 GMT
server
AkamaiNetStorage
etag
"ef0db5b99313fdba1fff149c4a0359cb:1645744697.871161"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
76930
expires
Fri, 25 Feb 2022 21:11:42 GMT
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=5.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1645819902358
  • https://dpm.demdex.net/id/rd?d_visid_ver=5.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1645819902358
367 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=5.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1645819902358
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Server
35.162.68.238 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-162-68-238.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
6cf987ab9ebb5a9e4fdc85b52ce610e1fc1cac645d71255d227f3393bf16cff7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

DCS
dcs-prod-usw2-2-v025-0b6db72e8.edge-usw2.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
wpOLBEdrQNU=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
311
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-usw2-1-v025-03a67e286.edge-usw2.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Origin
https://www.fortinet.com
X-TID
we7sF8BpT6g=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=5.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1645819902358
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
AppMeasurement.min.js
assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/ 		33 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/AppMeasurement.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
055e467aa53a9c0272d805bbc009ade8c74df5a8c1255271d753ac78fe179873

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
last-modified
Wed, 19 Jan 2022 22:18:26 GMT
server
AkamaiNetStorage
etag
"85722a02b6a7feb74d08ac7875516bee:1642630706.903013"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
12243
expires
Fri, 25 Feb 2022 21:11:42 GMT
AppMeasurement_Module_ActivityMap.min.js
assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/AppMeasurement_Module_ActivityMap.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
d4e77c7411d1de6efebf4278b9c98aa77dc2e5186cee271ac256138f17bef9f4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
last-modified
Wed, 19 Jan 2022 22:18:27 GMT
server
AkamaiNetStorage
etag
"9355415074dbdbd216a19b61ce931ab2:1642630707.219535"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
1599
expires
Fri, 25 Feb 2022 21:11:42 GMT
obtp.js
amplify.outbrain.com/cp/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://amplify.outbrain.com/cp/obtp.js
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.213.74 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-62-213-74.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
7e8ef05a55eafab5277e6449520107db94dfb01b497a52f283e7ffa6ee49363d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:42 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Feb 2022 12:30:38 GMT
Server
AkamaiNetStorage
ETag
"23b34d08f648c3f51b232443afced826:1644409863.170279"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=1200
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3150
Expires
Fri, 25 Feb 2022 20:31:42 GMT
6si.min.js
j.6sc.co/ 		27 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.123.161.196 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-123-161-196.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:42 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
8575
Pragma
no-cache
Last-Modified
Thu, 07 Oct 2021 17:17:43 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615f2bb7-6a5f"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Cache-Control
private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Fri, 25 Feb 2022 20:11:42 GMT
addthis_widget.js
s7.addthis.com/js/300/ 		353 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.195.108.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-195-108-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Fri, 25 Feb 2022 20:11:42 GMT
x-host
s7.addthis.com
content-length
116432
RC8b0bc4a0b33e4476a134b6c5193977e7-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		358 B
495 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RC8b0bc4a0b33e4476a134b6c5193977e7-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
2fa0eafa106eed3ad7922c6bc544582f2747ad19dd687fc649cda243a1cd360e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
229
expires
Fri, 25 Feb 2022 21:11:42 GMT
RC52075bdc49924bc1a58a4118ed15476d-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		1 KB
803 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RC52075bdc49924bc1a58a4118ed15476d-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
4925a85c1723e81894735b3c86dc169ed7fd10388ecf0f536a182336cfa660e8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
536
expires
Fri, 25 Feb 2022 21:11:42 GMT
bat.js
bat.bing.com/ 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
last-modified
Wed, 09 Feb 2022 23:54:49 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 8D559452BA8B490F8B85DFF9EDC17914 Ref B: YTO01EDGE0712 Ref C: 2022-02-25T20:11:42Z
etag
"806a236c101ed81:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
11333
RCc1cfec65776349c887b298772185fb67-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RCc1cfec65776349c887b298772185fb67-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
430260c1e98c636f2a9d13d7d4e159083abe889eaf5a58530dd779862ca32404

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
1341
expires
Fri, 25 Feb 2022 21:11:42 GMT
getuidj
secure.adnxs.com/ 		11 B
692 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.166 Secaucus, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 25 Feb 2022 20:11:42 GMT
X-Proxy-Origin
149.56.153.183; 149.56.153.183; 575.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
bad1a474-680f-4388-9e05-8a383d0f44ba
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/ 		47 B
372 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.123.161.196 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-123-161-196.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0cc212f18665e9c7c0da9aa9e47a1561339359db5474e985db999f0950a0ca97

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:42 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
17532650.js
bat.bing.com/p/action/ 		682 B
755 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/17532650.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ARR/3.0
Resource Hash
7020be4e3541c91f5c6eae33141472969e2af8975ff47d596dfbe7e9c5eff660

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 6E1C1DFE779C4599BA27A55052512FB0 Ref B: YTO01EDGE0712 Ref C: 2022-02-25T20:11:42Z
x-powered-by
ARR/3.0
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-store,no-cache
content-length
585
0
bat.bing.com/action/ 		0
152 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=02815b32-05b6-4dd7-a476-a06399e0802a&sid=26054030967711ec8446d77447d305c8&vid=260551f0967711ec942b13069f79c218&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&kw=Threat%20Research,cybercrime,Cybersecurity%20Architect&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&r=https%3A%2F%2Fapps.global.fortinet.com%2F&lt=1026&pt=1645819901178,,,,,0,1,2,2,75,25,75,356,379,359,958,958,1026,,,&pn=0,0&evt=pageLoad&msclkid=N&sv=1&rn=495818
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:42 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 4CE13D8EA2BD4D448597FA0CE2E3C9ED Ref B: YTO01EDGE0712 Ref C: 2022-02-25T20:11:42Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
cachedClickId
tr.outbrain.com/ 		35 B
239 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1
Requested by
Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.223 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
X-TraceId
29580c121530c3174c2f98b4bb1068b7
Content-Length
56
Content-Type
application/javascript
unifiedPixel
tr.outbrain.com/ 		43 B
256 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tr.outbrain.com/unifiedPixel?marketerId=00ad3119690e692fd6990245f9741ea8f1&obApiVersion=1.1&obtpVersion=1.6.0&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&optOut=false&bust=03427960622071715
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.223 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:42 GMT
Cache-Control
no-cache
X-TraceId
c1a99393145262ca9282020353c561ac
content-encoding
gzip
Content-Length
60
Content-Type
image/gif;
details
epsilon.6sense.com/v3/company/ 		813 B
655 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.50.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-50-252.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ea110358a3d9ed8f3e493e104b3e523e51b27653837899f2139762521ad1001c

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Referer
https://www.fortinet.com/
Accept-Language
en-CA,en;q=0.9
Authorization
Token 82f0c18bd0395219670f57108eb160f3273629b2
EpsilonCookie
4778ce177a8d0000fe371962ad010000f22a0a00

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.fortinet.com
access-control-allow-credentials
true
content-length
469
details
epsilon.6sense.com/v3/company/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.50.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-50-252.compute-1.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
authorization,epsiloncookie
Origin
https://www.fortinet.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
server
nginx
access-control-allow-origin
https://www.fortinet.com
access-control-allow-credentials
true
access-control-max-age
1800
access-control-allow-methods
OPTIONS,GET
access-control-allow-headers
authorization,epsiloncookie
img.gif
b.6sc.co/v1/beacon/ 		43 B
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=4778ce177a8d0000fe371962ad010000f22a0a00&session=33856b47-f88b-41ab-86ee-0c8d799c02be&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A42%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20has%20discovered%20evidence%20that%20the%20Nobelium%20Group%20is%20impersonating%20someone%20associated%20with%20the%20Turkish%20embassy%20as%20a%20lure%20to%20introduce%20a%20Cobalt%20Strike%20beacon%20payload%20and%20gain%20access.%20Read%20our%20blog%20to%20learn%20more.%22%2C%22keywords%22%3A%22Threat%20Research%2Ccybercrime%2CCybersecurity%20Architect%22%2C%22title%22%3A%22Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=https%3A%2F%2Fapps.global.fortinet.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pageViewId=4fab148b-4be9-4055-8112-279ae93ee2be&an_uid=0
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.59.105.202 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-59-105-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:42 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.62.213.139 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-62-213-139.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
A2D4D5599E262117
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=41981
accept-ranges
bytes
content-length
948
x-amz-id-2
GFVlkt9fPPry50ez1uPyg+4Tl03gEylFTORdZTbh/KWe+1xXYjjci111RYuC3urcJGirxhRW3kA=
api.min.js
a.opmnstr.com/app/js/ 		205 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.opmnstr.com/app/js/api.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
195.181.168.47 , United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
edge-742.bunnyinfra.net
Software
BunnyCDN-NY1-742 /
Resource Hash
507ce7426c190c3d954909e634c514914c57d3f311fc022b560260614b596196

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
br
cdn-edgestorageid
742
perma-cache
HIT
cdn-storageserver
DE-197
cdn-cachedat
02/25/2022 19:06:14
cdn-pullzone
293267
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode
200
server
BunnyCDN-NY1-742
access-control-allow-origin
*
last-modified
Fri, 25 Feb 2022 19:06:14 GMT
cdn-proxyver
1.02
cdn-fileserver
300
etag
W/"621928a6-33287"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid
27fb5cc068ac6b3046db5e90f9071826
cdn-requestcountrycode
CA
cdn-status
200
cdn-requestpullsuccess
True
clarity.js
d.clarity.ms/s/0.6.32/ 		53 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d.clarity.ms/s/0.6.32/clarity.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/17532650.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
3701cadc5fc84e8ad639f83a87e20d82575e3cc28d479d73a0e66e5230e71c65

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
br
etag
"1d8191fe855c690"
last-modified
Thu, 03 Feb 2022 17:03:04 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public,max-age=86400
accept-ranges
bytes
request-context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=82C91689BAAD41DC9B6E6A47B2DFFE03&RedC=c.clarity.ms&MXFR=30BF1B29015769981B8E0A7F055767F9
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=82C91689BAAD41DC9B6E6A47B2DFFE03&MUID=0309D56B7F296E6E3B61C43D7E836FED
42 B
465 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=82C91689BAAD41DC9B6E6A47B2DFFE03&MUID=0309D56B7F296E6E3B61C43D7E836FED
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
H2
Server
20.36.253.92 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:42 GMT
last-modified
Fri, 18 Feb 2022 23:15:27 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"6afd196a1d25d81:0"
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42

Redirect headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:42 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: BCD7B760A2064564BC4999007D26DB18 Ref B: YTO01EDGE0712 Ref C: 2022-02-25T20:11:42Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=82C91689BAAD41DC9B6E6A47B2DFFE03&MUID=0309D56B7F296E6E3B61C43D7E836FED
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
39852
api.omappapi.com/v2/embed/ 		12 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by
Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.230.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-230-39.jfk51.r.cloudfront.net
Software
Pagely Gateway/1.5.1 /
Resource Hash
9b3a768a0d2d23e86f3887b0b40ef0b35c39589dd4e9cac28adf957c045cfca3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
x-cache-config
0 0
x-amz-cf-pop
JFK51-C1
x-cache-status
HIT
x-cache
Miss from cloudfront
access-control-allow-headers
X-CSRF-Token
x-optinmonster-account
45602
x-user-agent
standard--
last-modified
Mon, 10 Jan 2022 23:26:02 GMT
server
Pagely Gateway/1.5.1
etag
W/"19044d83d9231dcbb9221d7815d20c00"
vary
Accept-Encoding, User-Agent
content-type
application/json
via
1.1 f800b68f44c427976fe7546b255b6206.cloudfront.net (CloudFront)
access-control-expose-headers
X-OptinMonster-Account, X-User-Agent
cache-control
public, max-age=30, stale-while-revalidate=1800
access-control-allow-origin
*
x-amz-cf-id
aVHFb880ClycG3bhBRVzt6zvn-8k_0iP5UMMjQwMUX54PD9cNmyfdw==
expires
Fri, 25 Feb 2022 19:45:42 GMT
hotjar-1178304.js
static.hotjar.com/c/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-1178304.js?sv=6
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.230.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-230-103.jfk51.r.cloudfront.net
Software
/
Resource Hash
812dbd37a9a9179ba0a674e7abc70b8f7a6af672a31605b49977d8cdfff8c1a7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
br
x-content-type-options
nosniff
age
31
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
1960
access-control-allow-origin
*
cache-control
max-age=60
etag
W/fe97b3c2979943e42861016f31a5cdd5
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
via
1.1 0abfc04b3868b6760be5e12dccdfc7d4.cloudfront.net (CloudFront)
x-cache-hit
1
x-amz-cf-pop
JFK51-C1
x-amz-cf-id
Jx7Z0xz5ex1CrX0pxOsS_9hO4o9YO2L4ij2zsxId9KaBQ7PDOxJZaA==
wid.tracker.js
www.argusplatform.com/js/
Redirect Chain
  • https://argusplatform.com/js/wid.tracker.js
  • https://www.argusplatform.com/js/wid.tracker.js
7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.argusplatform.com/js/wid.tracker.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
H2
Server
54.154.189.86 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-189-86.eu-west-1.compute.amazonaws.com
Software
Kestrel /
Resource Hash
72cca376440f971e2d99e3f8b7a50432517e8a75327360d35a3df8b896c3962d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Fri, 25 Feb 2022 11:46:51 GMT
server
Kestrel
etag
"1d82a3d60a19c6d-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
2395

Redirect headers

location
https://www.argusplatform.com/js/wid.tracker.js
date
Fri, 25 Feb 2022 20:11:43 GMT
server
Apache/2.4.29 (Ubuntu)
content-length
338
content-type
text/html; charset=iso-8859-1
js
www.googletagmanager.com/gtag/ 		94 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-767980-1
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2008 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
1ad1bc201badad52b9cfe16df478ba99053aef36ba4b5d457943a45bd6bb1d8e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37477
x-xss-protection
0
last-modified
Fri, 25 Feb 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 25 Feb 2022 20:11:42 GMT
dest5.html
fortinet.demdex.net/ Frame C66D 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fortinet.demdex.net/dest5.html?d_nsid=0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.88.252.250 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-252-250.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding
gzip
Content-Type
text/html;charset=UTF-8
date
Fri, 25 Feb 2022 20:11:43 GMT
DCS
dcs-prod-usw2-2-v025-0b258cd62.edge-usw2.demdex.com UNKNOWN
Expires
Thu, 01 Jan 1970 00:00:00 UTC
last-modified
Mon, 14 Feb 2022 16:08:38 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
vary
accept-encoding
X-TID
xdJRVa+jSTE=
Content-Length
2791
Connection
keep-alive
id
metrics.fortinet.com/ 		48 B
510 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://metrics.fortinet.com/id?d_visid_ver=5.3.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=31965837187116156332044189977076906900&ts=1645819902820
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.212.155.93 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-212-155-93.us-west-2.compute.amazonaws.com
Software
jag /
Resource Hash
b2545a170d38773dd41af8afa2c638580819811ec293586d4b7045daa394ca22
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-74fcddc49f-qgjv6
vary
Origin
x-c
main-1585.I7afc85.M0-540
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-javascript;charset=utf-8
content-length
48
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=Yhk3-gAAAHM3uQPl
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=32320825144907041532078492508500204060
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Yhk3-gAAAHM3uQPl
42 B
945 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Yhk3-gAAAHM3uQPl
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
HTTP/1.1
Server
35.162.68.238 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-162-68-238.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

DCS
dcs-prod-usw2-2-v025-0aa307831.edge-usw2.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
cTxaX4pJTPU=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Yhk3-gAAAHM3uQPl
Date
Fri, 25 Feb 2022 20:11:42 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::200e Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
5443
date
Fri, 25 Feb 2022 18:40:59 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Fri, 25 Feb 2022 20:40:59 GMT
0c5486a500a70ec79a100d1d8e375278-optin.json
a.omappapi.com/app/campaign-views/df0603609574/qxx1b0gslklfu2kjckea/ 		20 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a.omappapi.com/app/campaign-views/df0603609574/qxx1b0gslklfu2kjckea/0c5486a500a70ec79a100d1d8e375278-optin.json
Requested by
Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
37.19.206.70 , United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
unn-37-19-206-70.datapacket.com
Software
BunnyCDN-ASB1-759 /
Resource Hash
6bdeca02f38306151b71374cfbbbe73506a9af54f4e3a5d9f6c04a969ada3e1a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
br
cdn-edgestorageid
759
perma-cache
HIT
cdn-storageserver
DE-199
cdn-cachedat
02/23/2022 23:52:39
cdn-pullzone
293267
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode
200
server
BunnyCDN-ASB1-759
access-control-allow-origin
*
last-modified
Fri, 07 Jan 2022 04:12:07 GMT
cdn-proxyver
1.02
cdn-fileserver
291
etag
W/"61d7bd97-4fa6"
vary
Accept-Encoding
content-type
application/json
cdn-cache
HIT
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid
53ddc41ac38a8478f4b2c6ebab306007
cdn-requestcountrycode
CA
cdn-status
200
cdn-requestpullsuccess
True
modules.f9262b22b79803e6feba.js
script.hotjar.com/ 		236 KB
62 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.f9262b22b79803e6feba.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1178304.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.230.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-230-126.jfk51.r.cloudfront.net
Software
/
Resource Hash
1bded02879e2df34de7df88fc7dd7b325a01a4fbc5af6d0877d5e3364c23ce49
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 09:20:07 GMT
content-encoding
br
x-content-type-options
nosniff
age
39095
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
62920
access-control-allow-origin
*
last-modified
Fri, 25 Feb 2022 09:20:06 GMT
etag
"735da755ffe3d238685995ce935edbcb"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 27f14fa3828b5a3937a29b10d6b5aa0e.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
JFK51-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
NpgsC-Xm4O-cX0GzSqCejvmrlQ1vIRYfSPECOemaazsCbNbXsXeCmQ==
collect
d.clarity.ms/ 		0
71 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.clarity.ms/collect
Requested by
Host: d.clarity.ms
URL: https://d.clarity.ms/s/0.6.32/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.fortinet.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin
https://www.fortinet.com
date
Fri, 25 Feb 2022 20:11:42 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
box-acca23410e696f2ca3087d947271c3d0.html
vars.hotjar.com/ Frame 0B8A 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vars.hotjar.com/box-acca23410e696f2ca3087d947271c3d0.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1178304.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.230.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-230-122.jfk51.r.cloudfront.net
Software
/
Resource Hash
e0f23d16bb40b894855d19e097cc0b9f4695b98a7db1fed18625cfb1ce8bda35

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/

Response headers

content-type
text/html
content-length
1044
date
Fri, 04 Feb 2022 08:52:06 GMT
accept-ranges
bytes
cache-control
max-age=31536000
content-encoding
br
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
etag
"6f65fac4e8efe167ff5132c0c54c5729"
last-modified
Fri, 04 Feb 2022 08:51:39 GMT
x-robots-tag
none
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 4ffd9afb636b7eb92e42cf2534136d50.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK51-C1
x-amz-cf-id
ewg33jsPBs1SQNbnF5VDP0l9acApINx-kaJz_ww5Veckb7d_5pf9BA==
age
1855177
collect
www.google-analytics.com/j/ 		1 B
207 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=874755067&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&dr=https%3A%2F%2Fapps.global.fortinet.com%2F&ul=en-us&de=UTF-8&dt=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1338965290&gjid=1662792539&cid=1326092565.1645819903&tid=UA-767980-1&_gid=109904114.1645819903&_r=1&gtm=2ou2n0&z=628820680
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::200e Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:42 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
b4f2f7dbd4061616098231-social-img-banner-secure-cybersec-training_1024x160.jpg
a.omappapi.com/users/df0603609574/images/ 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.omappapi.com/users/df0603609574/images/b4f2f7dbd4061616098231-social-img-banner-secure-cybersec-training_1024x160.jpg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
37.19.206.70 , United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
unn-37-19-206-70.datapacket.com
Software
BunnyCDN-ASB1-759 /
Resource Hash
484894648719027fc265a9fad98eddfe18cee179cde0e98b780af731e6b30a4a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
cdn-edgestorageid
759
perma-cache
HIT
cdn-storageserver
DE-169
cdn-cachedat
02/25/2022 20:11:34
cdn-pullzone
293267
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-length
19336
server
BunnyCDN-ASB1-759
access-control-allow-origin
*
last-modified
Thu, 27 May 2021 18:28:19 GMT
cdn-proxyver
1.02
cdn-fileserver
98
etag
"60afe4c3-4b88"
content-type
image/webp
cdn-cache
HIT
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestpullcode
200
cdn-requestid
13b270e1cd1402ffa668fa2f4f04f983
accept-ranges
bytes
cdn-requestcountrycode
CA
cdn-status
200
cdn-requestpullsuccess
True
s07665942642630
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.4-LBWB/ 		43 B
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.4-LBWB/s07665942642630?AQB=1&ndh=1&pf=1&t=25%2F1%2F2022%2020%3A11%3A43%205%200&mid=31965837187116156332044189977076906900&aamlh=9&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Anobelium-returns-to-the-political-world-stage&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&r=https%3A%2F%2Fapps.global.fortinet.com%2F&cc=USD&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Anobelium-returns-to-the-political-world-stage&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.212.155.93 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-212-155-93.us-west-2.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
x-c
main-1585.I7afc85.M0-540
p3p
CP="This is not a P3P policy"
vary
*
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 26 Feb 2022 20:11:43 GMT
server
jag
xserver
anedge-74fcddc49f-rzlzl
etag
3534371330663120896-4619590542637716949
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 24 Feb 2022 20:11:43 GMT
s05694436641965
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.4-LBWB/ 		43 B
247 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.4-LBWB/s05694436641965?AQB=1&ndh=1&pf=1&t=25%2F1%2F2022%2020%3A11%3A43%205%200&mid=31965837187116156332044189977076906900&aamlh=9&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Anobelium-returns-to-the-political-world-stage&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&cc=USD&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&c4=www.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Anobelium-returns-to-the-political-world-stage&v35=Enabled&v101=pnfp.com&v102=Pinnacle%20Financial%20Partners&v103=%24500M%20-%20%241B&v104=1%2C000%20-%204%2C999&v105=Financial%20Services&v106=Montreal&v107=Quebec&v108=Canada&v109=Northern%20America&v110=52311&v111=Investment%20Banking%20and%20Securities%20Dealing&v112=2600&v113=645543000&v126=Very%20High&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.212.155.93 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-212-155-93.us-west-2.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
x-c
main-1585.I7afc85.M0-540
p3p
CP="This is not a P3P policy"
vary
*
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 26 Feb 2022 20:11:43 GMT
server
jag
xserver
anedge-74fcddc49f-md4v9
etag
3534371331089006592-4619817950531651788
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 24 Feb 2022 20:11:43 GMT
RC966743b5fdb047df849b9aa2c6faad9e-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		922 B
794 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RC966743b5fdb047df849b9aa2c6faad9e-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
6b6c67f54c9cae9226b2251489f4604e72a15890c09e4cab3f7686fbc6c42ace

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
527
expires
Fri, 25 Feb 2022 21:11:43 GMT
RC2ef20bc449244a1a985b07cb1ef5059a-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		847 B
743 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RC2ef20bc449244a1a985b07cb1ef5059a-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
d3f7b36acf8eb6845a2eb64c1cd115acf2c4c73cb81b64d968873d52528a6c66

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
476
expires
Fri, 25 Feb 2022 21:11:43 GMT
RC5cf00b5cc6354b20a80b61bc2f128836-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		664 B
666 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RC5cf00b5cc6354b20a80b61bc2f128836-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
9ca6e1bd00d52bdaa9899a8c8c87af7ebc4b65528cca3f4e200672814d5bf75f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
400
expires
Fri, 25 Feb 2022 21:11:43 GMT
RC359e0cac2a6442a48c2afb7b95464755-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		819 B
764 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RC359e0cac2a6442a48c2afb7b95464755-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
b0c70f9d21afd60b58ce1fea2625adbfa52135ea789949426309bd1defec5872

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
497
expires
Fri, 25 Feb 2022 21:11:43 GMT
RCf2367c4c413a4edba3e733df0f5fd0b2-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		2 KB
1021 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RCf2367c4c413a4edba3e733df0f5fd0b2-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
6a18b3c0a15fab8498292821e96772658557a7812cd0d2c34f2f73e0081f8c09

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
754
expires
Fri, 25 Feb 2022 21:11:43 GMT
js
www.googletagmanager.com/gtag/ 		101 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2008 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
42aba085cf8c8649680fcc508c922d3d3774fdac968af608b118c9b75292c0a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40937
x-xss-protection
0
last-modified
Fri, 25 Feb 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 25 Feb 2022 20:11:43 GMT
js
www.googletagmanager.com/gtag/ 		91 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2008 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
56be370775b0003fada1092da069ec70c1a1c1e6b9395e85301a3e059b454767
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37246
x-xss-protection
0
last-modified
Fri, 25 Feb 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 25 Feb 2022 20:11:43 GMT
js
www.googletagmanager.com/gtag/ 		101 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2008 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7229e3742e4e2024c384f75f57b55f157ec9484b3ee76eb6bfa2381ad0a130f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40936
x-xss-protection
0
last-modified
Fri, 25 Feb 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 25 Feb 2022 20:11:43 GMT
js
www.googletagmanager.com/gtag/ 		101 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2008 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
fed1a9fa30680dad50553270e1776c0c7db7b90ea6dac3373e1e77294af21399
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40939
x-xss-protection
0
last-modified
Fri, 25 Feb 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 25 Feb 2022 20:11:43 GMT
js
www.googletagmanager.com/gtag/ 		101 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2008 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9fc340f3124536c401070981407bf671cd21dbed9ecd311bc9ad6e03715848f1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40935
x-xss-protection
0
last-modified
Fri, 25 Feb 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 25 Feb 2022 20:11:43 GMT
js
www.googletagmanager.com/gtag/ 		101 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2008 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
fdfa3be46a0709e1b7d4af2cc96487fa867f2db7065bcc2663b0ae446e675ccb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40926
x-xss-protection
0
last-modified
Fri, 25 Feb 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 25 Feb 2022 20:11:43 GMT
RCa120729e8aac4d6eb9006c8249638d3d-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		766 B
714 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RCa120729e8aac4d6eb9006c8249638d3d-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
4f828cdeddc7cc8061dfb2bed5d92c0cca701df32f7b1bc0273c01cbde623314

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
447
expires
Fri, 25 Feb 2022 21:11:43 GMT
RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		819 B
767 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
175f90d7fb29bcf11a50b8555345fda4068908c88c5c55e33f6a52e18184a774

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
501
expires
Fri, 25 Feb 2022 21:11:43 GMT
RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		1021 B
866 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
39308a396e97df42bc3699b37ef93a00e6458765ba4e43291eb320e8bf24ed01

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
600
expires
Fri, 25 Feb 2022 21:11:43 GMT
RC1c3aed62846445afb6e8fe95756d2c91-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		754 B
713 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RC1c3aed62846445afb6e8fe95756d2c91-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
366ceeddfa3f83d84507dae95e949f01db7164d10b0f6cd23790816fb5861ad6

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
446
expires
Fri, 25 Feb 2022 21:11:43 GMT
RC27acd4fab2ae40a2a6dc921e88ee3ac3-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		1 KB
938 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RC27acd4fab2ae40a2a6dc921e88ee3ac3-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
7caf8b3b05dece083ff18c992c35b56ce60d853758ecd4ff805e1614233e1248

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
671
expires
Fri, 25 Feb 2022 21:11:43 GMT
RCfd72a596db204601a195886ad6f74b58-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		819 B
767 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RCfd72a596db204601a195886ad6f74b58-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
f83ca3e8299ce52ab2282f283eccd64729dda06b0f32a47959a4f10ff14ef9a1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
501
expires
Fri, 25 Feb 2022 21:11:43 GMT
RC54f5e6f339414e6282feb1bfd5110df3-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		1 KB
814 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RC54f5e6f339414e6282feb1bfd5110df3-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
1646e8a67bdf74190ba70cce752d0949795b2aab98336953114405e2f60e2ffb

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
547
expires
Fri, 25 Feb 2022 21:11:43 GMT
RCaf301bf390eb49f29672733c2389885b-source.min.js
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/ 		966 B
818 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/5d65da1ac8b5/RCaf301bf390eb49f29672733c2389885b-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:e800:1192::1e80 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
27a477c91992ade903773347f50b15bea9d3d6b540b50362dbdebe371f3ba879

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 23:18:18 GMT
server
AkamaiNetStorage
etag
"c38dd25e7e6786bdc4d8660bb030684e:1645744698.855816"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.fortinet.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
551
expires
Fri, 25 Feb 2022 21:11:43 GMT
ipinfo
site.fortinet.com/utilservice/ 		201 B
771 B 		Script
General
Check archive.org
Download Go to
Full URL
https://site.fortinet.com/utilservice/ipinfo?site=fortinet.com&callback=jQuery22003967518022128316_1645819902135&_=1645819902136
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.45.36.159 Santa Clara, United States, ASN40934 (FORTINET, US),
Reverse DNS
Software
nginx/1.20.2 /
Resource Hash
8eb5d5a80b01da6441ef887899a0b088728b9ef621054a97c14fc889f69aee54
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.fortinet.com *.myfortinet.com fortinet.my.salesforce.com;
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors 'self' *.fortinet.com *.myfortinet.com fortinet.my.salesforce.com;
Server
nginx/1.20.2
Date
Fri, 25 Feb 2022 20:11:44 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
application/json;charset=UTF-8
Connection
keep-alive
Content-Length
201
Front-End-Https
on
/
pixels.argusplatform.com/wh/track/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://pixels.argusplatform.com/wh/track/?site_id=C6AC00C8269540D0ABFF19F1B5558B6D&visitor_id=1645819903149090283&event_type=page_request&timestamp=1645819903&page_title=Nobelium+Returns+to+the+Political+World+Stage+%7C+FortiGuard+Labs%C2%A0&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&page_url_referer=https%3A%2F%2Fapps.global.fortinet.com%2F&callback=jQuery22003967518022128316_1645819902137&_=1645819902138
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
34.251.139.24 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-139-24.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers
js
www.googletagmanager.com/gtag/ 		101 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-631698094
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2008 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
09b8e25d8cb3cefc967aa2d7026ca52211875c9d02a3051dc7a9383442003a26
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40927
x-xss-protection
0
last-modified
Fri, 25 Feb 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 25 Feb 2022 20:11:43 GMT
roundtrip.js
s.adroll.com/j/ 		46 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21ec:1a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d62a3b924d49cc3909d8c7e7d66c6fda8780c357fae0f927993f424928401b20

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id
mLgRV7jYHDvB6wDphJKX5Q2F5vg5l49f
Content-Encoding
gzip
Etag
W/"b8caabe626e64605e61edd5174246bf4"
Age
1607
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 9a3e0ef03bf0c78d769c66eb676df48c.cloudfront.net (CloudFront)
Last-Modified
Mon, 07 Feb 2022 16:47:41 GMT
Server
AmazonS3
Date
Fri, 25 Feb 2022 19:45:01 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
JFK51-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
MQb9b8rx9rhWCZQATXZRuo8bwwfQaAa6Dxw2Z1URyKbXFUnL6XXlJg==
img.gif
b.6sc.co/v1/beacon/ 		43 B
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=4778ce177a8d0000fe371962ad010000f22a0a00&session=33856b47-f88b-41ab-86ee-0c8d799c02be&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A42%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%221005%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20has%20discovered%20evidence%20that%20the%20Nobelium%20Group%20is%20impersonating%20someone%20associated%20with%20the%20Turkish%20embassy%20as%20a%20lure%20to%20introduce%20a%20Cobalt%20Strike%20beacon%20payload%20and%20gain%20access.%20Read%20our%20blog%20to%20learn%20more.%22%2C%22keywords%22%3A%22Threat%20Research%2Ccybercrime%2CCybersecurity%20Architect%22%2C%22title%22%3A%22Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=https%3A%2F%2Fapps.global.fortinet.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pageViewId=4fab148b-4be9-4055-8112-279ae93ee2be&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.59.105.202 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-59-105-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:43 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ 		1006 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:13::17d7:825a New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
0055b9d0429e9c194b4aa6b5f49cbc2ec31a7220ee7c8c186a9ee951feabd482

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:43 GMT
Content-Encoding
gzip
Last-Modified
Thu, 17 Feb 2022 18:48:07 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=15816
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
479
tag.aspx
ml314.com/ 		31 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/tag.aspx?251
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.103.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-103-83.compute-1.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
cd5489dc88fd8e9e9ea9cacf8077f8b20446d10fab97186491fe62079051a10d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:42 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=86400
transfer-encoding
chunked
Connection
keep-alive
uwt.js
static.ads-twitter.com/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
last-modified
Sat, 05 Feb 2022 00:34:56 GMT
etag
"8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
5410
x-served-by
cache-iad-kiad7000061-IAD
spx
dx.mountain.com/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=https%3A%2F%2Fapps.global.fortinet.com%2F&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&cb=52649524641775060term=value
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
54.69.255.140 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-69-255-140.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
1fd9a00fd5df278e713e45375b2c46517c7d254ad6cf356f7d4b996b1f636982

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
connection
close
content-type
application/javascript;charset=utf-8
vary
accept-encoding,origin,access-control-request-headers,access-control-request-method,accept-encoding
expires
Thu, 01 Jan 1970 00:00:00 GMT
fbevents.js
connect.facebook.net/en_US/ 		99 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
26236
x-xss-protection
0
pragma
public
x-fb-debug
fs8ue72Yi09llUZtbpnWobyl7+qkyM8nSnh8ol14rTHamfnYLuVGUPlAncrrer3iP5CMhpd3/U6plUR3dbUoOA==
x-fb-trip-id
1512268381
x-frame-options
DENY
date
Fri, 25 Feb 2022 20:11:43 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786
10104846.fls.doubleclick.net/activityi;dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/ Frame 16AA
Redirect Chain
  • https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;t...
  • https://10104846.fls.doubleclick.net/activityi;dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-politi...
650 B
494 B 		Document
General
Check archive.org
Download Go to
Full URL
https://10104846.fls.doubleclick.net/activityi;dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786?
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.38 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f6.1e100.net
Software
cafe /
Resource Hash
1280aaeef25bfb5b1b64c921ec4a505f623678c64a8e132552a3f00796933262
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 25 Feb 2022 20:11:43 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
469
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 25 Feb 2022 20:11:43 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://10104846.fls.doubleclick.net/activityi;dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
conversion_async.js
www.googleadservices.com/pagead/ 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s71-in-f2.1e100.net
Software
cafe /
Resource Hash
cae0ae2d67aac89367108586ebd25e00afc5d0f8110e6eb71b8d274037f7a5d8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14884
x-xss-protection
0
server
cafe
etag
16747055602125368176
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 25 Feb 2022 20:11:43 GMT
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
762 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/exp/index.js
Protocol
HTTP/1.1
Server
2600:9000:21ec:1a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id
VxC0v7SN4NsT_sJxZYoy27yA4ALlRfhC
Via
1.1 b96e96fef61e11f1c624b4bdd0ad939e.cloudfront.net (CloudFront)
Etag
"5816cced8568d223aa09d889f300692b"
Age
42604
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
28
Last-Modified
Mon, 18 Oct 2021 21:07:54 GMT
Server
AmazonS3
Date
Fri, 25 Feb 2022 08:21:44 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
JFK51-C1
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
AhiNWWXiwzzuniLYxMR0VFmCPT--uWYAslQgqnQxX--YM6DpLhITlA==

Redirect headers

Date
Fri, 25 Feb 2022 04:47:51 GMT
Via
1.1 9a3e0ef03bf0c78d769c66eb676df48c.cloudfront.net (CloudFront)
Age
55431
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
JFK51-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
GReubvetE8oH8S95EBExRrzlp-TtsPt2S3qKo4zsquQq1_Lqi0Q_Ng==
index.js
s.adroll.com/j/pre/
Redirect Chain
  • https://s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/fpconsent.js
  • https://s.adroll.com/j/pre/index.js
0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/pre/index.js
Protocol
HTTP/1.1
Server
2600:9000:21ec:1a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id
nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Via
1.1 9a3e0ef03bf0c78d769c66eb676df48c.cloudfront.net (CloudFront)
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Age
29614
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Wed, 15 Jan 2020 23:54:18 GMT
Server
AmazonS3
Date
Fri, 25 Feb 2022 11:58:40 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
JFK51-C1
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
lx_O_rr3DSfiCML9AQQCQLiP-uqhWlaHBuzZbK2dk6K8iRJQkqIqiQ==

Redirect headers

Date
Fri, 25 Feb 2022 19:54:38 GMT
Via
1.1 9a3e0ef03bf0c78d769c66eb676df48c.cloudfront.net (CloudFront)
Age
1024
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Location
https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
JFK51-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
xZnH0wg196Sxtuq5L867ovy977fjvX0p7OQs91APOSipoUMVt45avg==
index.js
s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/ 		4 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21ec:1a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
41f1e9970b646aadac0f40543bb08b21e49990bf1b09392d1ef4d71b275069ea

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id
z5t4EIs5JBSdkmgyvrwx6VKPZawk4V2t
Content-Encoding
gzip
Etag
W/"33ed216ef4569e95a97e55fb39d91d38"
Age
93
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 4fe583422d0b309b9b1d4505e54b137c.cloudfront.net (CloudFront)
Last-Modified
Mon, 21 Feb 2022 13:55:34 GMT
Server
AmazonS3
Date
Fri, 25 Feb 2022 20:10:38 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
JFK51-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
yggqE9V-Y9A4fnmm9W6mdIiIMZZLGIPWoOatg0LRsxdic9mjkW7i1Q==
insight.old.min.js
snap.licdn.com/li.lms-analytics/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:13::17d7:825a New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:43 GMT
Content-Encoding
gzip
Last-Modified
Wed, 16 Feb 2022 23:50:54 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=21876
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2036
adsct
analytics.twitter.com/i/ 		31 B
237 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o6ezf&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=f7b28cce-050b-467a-8c57-300f248b6091&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&tpx_cb=twttr.conversion.loadPixels
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time
7
date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
server
tsa_b
strict-transport-security
max-age=631138519
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0
x-connection-hash
f00f6fa75b6ecdb71212399e698a6b4f28ced8c85a079bf03b64b715e48def3b
content-type
application/javascript;charset=utf-8
content-length
57
adsct
analytics.twitter.com/i/ 		31 B
211 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=b13c6e75-bb05-4cdf-a1f0-15d3ff3d852c&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&tpx_cb=twttr.conversion.loadPixels
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time
7
date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
server
tsa_b
strict-transport-security
max-age=631138519
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0
x-connection-hash
f00f6fa75b6ecdb71212399e698a6b4f28ced8c85a079bf03b64b715e48def3b
content-type
application/javascript;charset=utf-8
content-length
57
adsct
analytics.twitter.com/i/ 		31 B
458 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o72wb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=ea3d4c74-ae6d-46e8-89a5-683511042a5f&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&tpx_cb=twttr.conversion.loadPixels
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time
5
date
Fri, 25 Feb 2022 20:11:42 GMT
content-encoding
gzip
server
tsa_b
strict-transport-security
max-age=631138519
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0
x-connection-hash
f00f6fa75b6ecdb71212399e698a6b4f28ced8c85a079bf03b64b715e48def3b
content-type
application/javascript;charset=utf-8
content-length
57
adsct
t.co/i/ 		43 B
184 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o6ezf&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=f7b28cce-050b-467a-8c57-300f248b6091&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time
7
date
Fri, 25 Feb 2022 20:11:43 GMT
server
tsa_b
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
9aff6e2ca280e1f51767b3fdd3ce59a0b4fdd7542d3c8bf4b89d7fc2e5be6781
content-length
43
adsct
t.co/i/ 		43 B
206 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=b13c6e75-bb05-4cdf-a1f0-15d3ff3d852c&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time
7
date
Fri, 25 Feb 2022 20:11:43 GMT
server
tsa_b
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
9aff6e2ca280e1f51767b3fdd3ce59a0b4fdd7542d3c8bf4b89d7fc2e5be6781
content-length
43
adsct
t.co/i/ 		43 B
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o72wb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=ea3d4c74-ae6d-46e8-89a5-683511042a5f&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time
7
date
Fri, 25 Feb 2022 20:11:42 GMT
server
tsa_b
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
9aff6e2ca280e1f51767b3fdd3ce59a0b4fdd7542d3c8bf4b89d7fc2e5be6781
content-length
43
177020962864941
connect.facebook.net/signals/config/ 		307 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/177020962864941?v=2.9.52&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
7dd370e6f3c7479b2e8b0c4e2e4965fb0dc2ca9ce2a541cc0624b069b062471a
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
89169
x-xss-protection
0
pragma
public
x-fb-debug
4tz/6NNSct75Qa1AW8ZddoRd6XgX7ZDwwtXxQFBw/7LYc7do0QUvlSfE2kxwYbGrry17Wnpw1G262CZLMaSDjQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Fri, 25 Feb 2022 20:11:43 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
p.adsymptotic.com/d/px/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1645819903645&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1645819903645&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&cookiesTest=true
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26time%3D1645819903645%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1645819903645&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&cookiesTest=tr...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1645819903645&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&cookiesTest=t...
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=3f02fde736ed7929b18690aa...
43 B
142 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=3f02fde736ed7929b18690aaa1fad693
Protocol
H2
Server
104.18.102.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6e3395a16d3454af-YYZ
p3p
CP='NON DSP COR CONi OUR BUS CNT'
content-type
image/gif
content-length
43

Redirect headers

location
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=3f02fde736ed7929b18690aaa1fad693
date
Fri, 25 Feb 2022 20:11:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
6e3395a11cab54af-YYZ
content-length
0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/631698094/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/631698094/?random=1645819903647&cv=9&fst=1645819903647&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
632f0f84c55593d43d3a8a5b38e848796f8d3cf0f643a130d0e27a8055d0fa98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1121
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/?random=1645819903651&cv=9&fst=1645819903651&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
34c51c6df81406b38dad24d92f1dc72609faf576f40e175a3a491d4f58edef20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1123
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1645819903653&cv=9&fst=1645819903653&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
32e3eede21caea5ec1a99bdf52568e1dc98035ec955b0f06386d1dac0d609666
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1123
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1645819903654&cv=9&fst=1645819903654&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
46f72f8df104a00bc87acd732b098046f71aca9ce1b7bf87fa3a766b8ff46f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1123
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
7OBVBCAQE5FHDPFEAD5T4D
d.adroll.com/consent/check/ 		387 B
856 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D?arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&_s=1972362152ce0d3959f007a110d10a86&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.208.223.190 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-208-223-190.compute-1.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
c73f24ae3ba3968a628f797e9f78ea2694531ff2bde63a116d9ea1ffc58e4597

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-type
application/javascript
content-length
387
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
/
www.facebook.com/tr/ 		44 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&rl=https%3A%2F%2Fapps.global.fortinet.com%2F&if=false&ts=1645819903701&sw=1600&sh=1200&v=2.9.52&r=stable&ec=0&o=30&fbp=fb.1.1645819903700.1440365010&it=1645819903603&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length
44
expires
Fri, 25 Feb 2022 20:11:43 GMT
/
adservice.google.com/ddm/fls/i/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;... Frame B68B 		649 B
939 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786;~oref=https://www.fortinet.com/
Requested by
Host: 10104846.fls.doubleclick.net
URL: https://10104846.fls.doubleclick.net/activityi;dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
154130f3cc3a91c2dcdec666bebfc5e5a2ca6c80ecd2fd792a508d09626b5840
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://10104846.fls.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 25 Feb 2022 20:11:43 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
470
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
www.google.com/pagead/1p-user-list/729495989/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/729495989/?random=1645819903651&cv=9&fst=1645819200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&async=1&fmt=3&is_vtc=1&random=3059062763&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/729495989/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/729495989/?random=1645819903651&cv=9&fst=1645819200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&async=1&fmt=3&is_vtc=1&random=3059062763&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/631698094/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/631698094/?random=1645819903647&cv=9&fst=1645819200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&async=1&fmt=3&is_vtc=1&random=3907627286&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/631698094/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/631698094/?random=1645819903647&cv=9&fst=1645819200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&async=1&fmt=3&is_vtc=1&random=3907627286&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/609297413/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/609297413/?random=1645819903653&cv=9&fst=1645819200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&async=1&fmt=3&is_vtc=1&random=2158594216&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/609297413/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/609297413/?random=1645819903653&cv=9&fst=1645819200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&async=1&fmt=3&is_vtc=1&random=2158594216&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/662878185/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/662878185/?random=1645819903654&cv=9&fst=1645819200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&async=1&fmt=3&is_vtc=1&random=2452818413&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/662878185/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/662878185/?random=1645819903654&cv=9&fst=1645819200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2n0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&ref=https%3A%2F%2Fapps.global.fortinet.com%2F&tiba=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%C2%A0&async=1&fmt=3&is_vtc=1&random=2452818413&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
utsync.ashx
ml314.com/ 		535 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pv=1645819903620_l53rgr87y&bl=en-us&cb=194336&return=&ht=&d=&dc=&si=1645819903620_l53rgr87y&cid=&s=1600x1200&rp=https%3A%2F%2Fapps.global.fortinet.com%2F
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?251
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.103.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-103-83.compute-1.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
f5975a6c757aab157ba24a9a879798eb43c75380a87e421a4d8e3bec8a85991e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 25 Feb 2022 20:11:43 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
private
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
435
Expires
0
VGLVDYA6GRASZMUSTHUV5D.js
s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/
Redirect Chain
  • https://d.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fn...
  • https://s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/VGLVDYA6GRASZMUSTHUV5D.js
9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/VGLVDYA6GRASZMUSTHUV5D.js
Protocol
HTTP/1.1
Server
2600:9000:21ec:1a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b175564106ad5e553a2e98b8e44e8c10c8d7bf8e48886001d85d6a6583763439

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id
YD0wdDT.TQ6fHk2Kg80TGXltjmRqr.zm
Content-Encoding
gzip
Etag
W/"008ce3c04b5e435ec5c1a09979caa8f4"
Age
3523
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 b96e96fef61e11f1c624b4bdd0ad939e.cloudfront.net (CloudFront)
Last-Modified
Wed, 02 Feb 2022 19:13:58 GMT
Server
AmazonS3
Date
Fri, 25 Feb 2022 19:13:39 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
JFK51-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
aDx6WVLS3oF8NpoAh424Fy90jlbWo0yaNba3UXu5vaGOYhRuYzEfVQ==

Redirect headers

date
Fri, 25 Feb 2022 20:11:43 GMT
x-segment-display-name
Visitors to Unsegmented Pages
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
x-rule-type
p
content-length
0
pragma
no-cache
x-conversion-value
0.00
server
nginx/1.20.0
x-rule
*
x-segment-eid
VGLVDYA6GRASZMUSTHUV5D
location
https://s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/VGLVDYA6GRASZMUSTHUV5D.js
cache-control
no-store, no-cache, must-revalidate
x-pixel-eid
GIVUJ77KRNF4LOPGYJ6RS5
x-segment-name
*
x-advertisable-eid
7OBVBCAQE5FHDPFEAD5T4D
x-conversion-currency
ibs:dpid=22052&dpuuid=3625396256698794042&redir=
dpm.demdex.net/ 		42 B
945 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3625396256698794042&redir=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.162.68.238 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-162-68-238.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

DCS
dcs-prod-usw2-1-v025-0ceb10668.edge-usw2.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
xXqvirbaTQs=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC
utsync.ashx
ml314.com/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
  • https://ml314.com/utsync.ashx?eid=53819&et=0&fp=6efcbacd-059a-41f4-ade0-df1ed7058974&gdpr=0&gdpr_consent=
43 B
656 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=6efcbacd-059a-41f4-ade0-df1ed7058974&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
52.21.103.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-103-83.compute-1.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 25 Feb 2022 20:11:43 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
0,Sat, 26 Feb 2022 15:11:43 GMT

Redirect headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=6efcbacd-059a-41f4-ade0-df1ed7058974&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
241
csync.ashx
ml314.com/
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3625396256698794042
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3625396256698794042
  • https://ml314.com/csync.ashx?fp=ccd222cbcfd591bd250aee60c572d50c&eid=50146&person_id=3625396256698794042
43 B
312 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/csync.ashx?fp=ccd222cbcfd591bd250aee60c572d50c&eid=50146&person_id=3625396256698794042
Protocol
HTTP/1.1
Server
52.21.103.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-103-83.compute-1.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:43 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Sat, 26 Feb 2022 15:11:44 GMT

Redirect headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:44 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location
https://ml314.com/csync.ashx?fp=ccd222cbcfd591bd250aee60c572d50c&eid=50146&person_id=3625396256698794042
cache-control
no-cache
x-server
10.40.47.161
content-length
0
expires
0
match
ps.eyeota.net/
Redirect Chain
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2NAjb7rZpI9w_GccQPQMFhDWbWOo7miVprMsEQ1e1L0o&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
  • https://ml314.com/csync.ashx?fp=2NAjb7rZpI9w_GccQPQMFhDWbWOo7miVprMsEQ1e1L0o&person_id=3625396256698794042&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil%26referre...
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
70 B
440 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Protocol
HTTP/1.1
Server
54.156.26.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-156-26-12.compute-1.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:44 GMT
Content-Type
image/gif
Content-Length
70
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Date
Fri, 25 Feb 2022 20:11:43 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
text/html; charset=utf-8
Location
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Cache-Control
private
Connection
keep-alive
Content-Length
193
Expires
Sat, 26 Feb 2022 15:11:44 GMT
/
10104846.fls.doubleclick.net/ddm/fls/r/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-worl... Frame 4C2D
Redirect Chain
  • https://adservice.google.ca/ddm/fls/i/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world...
  • https://10104846.fls.doubleclick.net/ddm/fls/r/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-politi...
335 B
300 B 		Document
General
Check archive.org
Download Go to
Full URL
https://10104846.fls.doubleclick.net/ddm/fls/r/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786;~oref=https://www.fortinet.com/
Requested by
Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786;~oref=https://www.fortinet.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.38 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f6.1e100.net
Software
cafe /
Resource Hash
c6cebb694e1b4a62ee0ddcf1d387ed1b92b755ff2294460f4757498eaff1a749
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://adservice.google.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 25 Feb 2022 20:11:44 GMT
expires
Fri, 25 Feb 2022 20:11:44 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
277
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 25 Feb 2022 20:11:43 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
location
https://10104846.fls.doubleclick.net/ddm/fls/r/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786;~oref=https://www.fortinet.com/
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
sendrolling.js
s.adroll.com/j/ 		11 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/sendrolling.js
Requested by
Host: d.adroll.com
URL: https://d.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pv=49226025165.526855&cookie=&adroll_s_ref=https%3A//apps.global.fortinet.com/&keyw=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21ec:1a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
134568be83d33ab28a55e78e8e8ac638ac6a57ff1bfc62bb5bc4e93fee39e20f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id
fZGjkyAZHTj1TgJDzII.lvvfl8Ivg3ps
Content-Encoding
gzip
Etag
W/"c317a5be7d65fa0c4d68d9735af020e4"
Age
112
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 b96e96fef61e11f1c624b4bdd0ad939e.cloudfront.net (CloudFront)
Last-Modified
Thu, 27 Jan 2022 17:28:49 GMT
Server
AmazonS3
Date
Fri, 25 Feb 2022 20:09:55 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
JFK51-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
ivakYpzydVlYnkSMstsDCGkH-K1vQIi3X0-2D8dGwHgN9fWNttkC8Q==
719861091558308
connect.facebook.net/signals/config/ 		307 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/719861091558308?v=2.9.52&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
f87c3386ed26d681a833078b5a6f3fcf5e7495dc57d70aba7be783a0fc2f70a1
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
89111
x-xss-protection
0
pragma
public
x-fb-debug
dHA1gGS7u4zG+AnUbXMzhJ4jZBNif/XUn9wTMsk6gINR90BhqKhDeIPNv74xlxlskgcdOJfqS63fFZBdPCd4iQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Fri, 25 Feb 2022 20:11:43 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
p.adsymptotic.com/d/px/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?pid=2148604&fmt=gif
  • https://px4.ads.linkedin.com/collect?pid=2148604&fmt=gif&e_ipv6=AQKGWj-ODQkXUQAAAX8ygr-zoTn2fLPVA-0wT8M0vXmJHBMQbuwwezRWWobZ_EQrAGxwOCFl
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=f48c8aeca073176c4c0dadd0...
43 B
97 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=f48c8aeca073176c4c0dadd06a1ad252
Protocol
H2
Server
104.18.102.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6e3395a1fe0354af-YYZ
p3p
CP='NON DSP COR CONi OUR BUS CNT'
content-type
image/gif
content-length
43

Redirect headers

location
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=f48c8aeca073176c4c0dadd06a1ad252
date
Fri, 25 Feb 2022 20:11:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
6e3395a11ca854af-YYZ
content-length
0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
rum
dsum-sec.casalemedia.com/
Redirect Chain
  • https://d.adroll.com/cm/index/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-...
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&expiration=1677355903
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&expiration=1677355903&C=1
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&expiration=1677355903&C=1
Protocol
HTTP/1.1
Server
23.62.212.240 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-62-212-240.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 25 Feb 2022 20:11:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 25 Feb 2022 20:11:44 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 25 Feb 2022 20:11:44 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&expiration=1677355903&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
333
Expires
Fri, 25 Feb 2022 20:11:44 GMT
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://d.adroll.com/cm/n/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stag...
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&expires=365
42 B
798 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&expires=365
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
4f2e9ddc15e6cc2c3861f8e2683d2514
Content-Type
image/gif

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&expires=365
pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
124
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
sync
ups.analytics.yahoo.com/ups/55980/
Redirect Chain
  • https://d.adroll.com/cm/onevideo/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-wor...
  • https://pixel.advertising.com/ups/55980/sync?uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
  • https://pixel.advertising.com/ups/55980/sync?uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
  • https://ups.analytics.yahoo.com/ups/55980/sync?uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP26e99781-9677-11ec-b0b6-0a...
  • https://ups.analytics.yahoo.com/ups/55980/sync?uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP26e99781-9677-11ec-b0b6-0a...
0
122 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55980/sync?uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP26e99781-9677-11ec-b0b6-0aa04754be25&verify=true
Protocol
H2
Server
3.218.90.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-90-66.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:44 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/55980/sync?uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP26e99781-9677-11ec-b0b6-0aa04754be25&verify=true
date
Fri, 25 Feb 2022 20:11:44 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
cookie-sync
sync.outbrain.com/
Redirect Chain
  • https://d.adroll.com/cm/outbrain/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-wor...
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
0
477 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.outbrain.com/cookie-sync?p=adroll&uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
Protocol
HTTP/1.1
Server
70.42.32.31 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:43 GMT
Cache-Control
no-cache
X-TraceId
c9cdab451cbb3b4212e8c1a313561ed7
Content-Length
0

Redirect headers

location
https://sync.outbrain.com/cookie-sync?p=adroll&uid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
100
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pug
image2.pubmatic.com/AdServer/
Redirect Chain
  • https://d.adroll.com/cm/pubmatic/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-wor...
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXy...
42 B
588 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
cache-control
no-store, no-cache, private
x-lat
va1pug016:0:519
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
212
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
v1
ads.yahoo.com/cms/
Redirect Chain
  • https://d.adroll.com/cm/r/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stag...
  • https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
0
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Protocol
H2
Server
2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

location
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
165
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
rtb-h
sync.taboola.com/sg/adroll-network/1/
Redirect Chain
  • https://d.adroll.com/cm/taboola/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-worl...
  • https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
0
222 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
17589

Redirect headers

location
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
pragma
no-cache
date
Fri, 25 Feb 2022 20:11:43 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
111
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
xuid
eb2.3lift.com/
Redirect Chain
  • https://d.adroll.com/cm/triplelift/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-w...
  • https://eb2.3lift.com/xuid?mid=4714&xuid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&dongle=c85e
  • https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
/xuid?ld=1&mid=4714&xuid=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=
date
Fri, 25 Feb 2022 20:11:43 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
sync
x.bidswitch.net/ul_cb/
Redirect Chain
  • https://d.adroll.com/cm/b/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stag...
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
43 B
510 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
Protocol
HTTP/1.1
Server
35.211.178.172 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
172.178.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:44 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
Date
Fri, 25 Feb 2022 20:11:44 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
bounce
ib.adnxs.com/
Redirect Chain
  • https://d.adroll.com/cm/x/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stag...
  • https://ib.adnxs.com/setuid?entity=172&code=NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
Protocol
HTTP/1.1
Server
68.67.160.114 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 25 Feb 2022 20:11:43 GMT
X-Proxy-Origin
149.56.153.183; 149.56.153.183; 672.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
70326024-b27f-4c51-b40a-87de1c1eae7a
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 25 Feb 2022 20:11:43 GMT
X-Proxy-Origin
149.56.153.183; 149.56.153.183; 672.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
33366ec0-e10d-4e84-b658-803179e54f03
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
458249.gif
idsync.rlcdn.com/
Redirect Chain
  • https://d.adroll.com/cm/l/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stag...
  • https://idsync.rlcdn.com/377928.gif?partner_uid=5efecbec43b83ea17f137a72ff33182b
  • https://idsync.rlcdn.com/1000.gif?memo=CMiIFxIrCicIARDqIhogNWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmIQABoNCP_v5JAGEgUI6AcQAEIASgA
  • https://pippio.com/api/sync?pid=5324&it=1&iv=c3ac372baf877012b0a84f1140022bcdc6673c6ebf8988c7d0e914b6fd23990d791426b5417dce21&_=2
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBjM2FjMzcyYmFmODc3MDEyYjBhODRmMTE0MDAyMmJjZGM2NjczYzZlYmY4OTg4YzdkMGU5MTRiNmZkMjM5OTBkNzkxNDI2YjU...
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBjM2FjMzcyYmFmODc3MDEyYjBhODRmMTE0MDAyMmJjZGM2NjczYzZlYmY4OTg4YzdkMGU5MTRiNmZkMjM5OTBkNzkxNDI2YjU0MTdkY2UyMRAAGgwIgPDkkAYSBAgCEABCAEoA&goog...
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
  • https://idsync.rlcdn.com/458249.gif?partner_uid=2816a7a3-0f9b-4521-9cfe-0c88284230c0
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/458249.gif?partner_uid=2816a7a3-0f9b-4521-9cfe-0c88284230c0
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 25 Feb 2022 20:11:44 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

location
https://idsync.rlcdn.com/458249.gif?partner_uid=2816a7a3-0f9b-4521-9cfe-0c88284230c0
date
Fri, 25 Feb 2022 20:11:44 GMT
via
1.1 google
x-samesite
secure
alt-svc
clear
content-length
111
content-type
text/html; charset=utf-8
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://d.adroll.com/cm/o/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stag...
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=5efecbec43b83ea17f137a72ff33182b
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=5efecbec43b83ea17f137a72ff33182b
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=5efecbec43b83ea17f137a72ff33182b
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/17.1.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:44 GMT
via
1.1 google
server
OXGW/17.1.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=5efecbec43b83ea17f137a72ff33182b
date
Fri, 25 Feb 2022 20:11:43 GMT
via
1.1 google
server
OXGW/17.1.0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
p3p
CP="CUR ADM OUR NOR STA NID"
in
d.adroll.com/cm/g/
Redirect Chain
  • https://d.adroll.com/cm/g/out?adroll_fpc=5ad8fc2f0f3b444db980e10955d5734a-1645819903811&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stag...
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=Xv7L7EO4PqF_E3py_zMYKw
  • https://d.adroll.com/cm/g/in
42 B
536 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/cm/g/in
Protocol
H2
Server
3.208.223.190 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-208-223-190.compute-1.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:44 GMT
server
nginx/1.20.0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
42
x-result
g.-1.-1.-1

Redirect headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:44 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://d.adroll.com/cm/g/in
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
225
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=719861091558308&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&rl=https%3A%2F%2Fapps.global.fortinet.com%2F&if=false&ts=1645819903923&cd[segment_eid]=VGLVDYA6GRASZMUSTHUV5D&sw=1600&sh=1200&v=2.9.52&r=stable&ec=0&o=29&fbp=fb.1.1645819903700.1440365010&it=1645819903603&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:43 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority
u=3,i
expires
Fri, 25 Feb 2022 20:11:43 GMT
st
px.mountain.com/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://px.mountain.com/st?ga_tracking_id=UA-767980-1&ga_client_id=1326092565.1645819903&shpt=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22UA-767980-1%22%2C%22ga_client_id%22%3A%221326092565.1645819903%22%2C%22shpt%22%3A%22Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221326092565.1645819903%22%2C%22dcm_gid%22%3A%22109904114.1645819903%22%2C%22ga_gclid%22%3A%221326092565.1645819903%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A1%2C%22getClientIdByGA%22%3A%22OK%22%2C%22ga_gclid%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%7D%7D&dcm_cid=1326092565.1645819903&dcm_gid=109904114.1645819903&dxver=4.0.0&shaid=32336&tdr=https%3A%2F%2Fapps.global.fortinet.com%2F&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&cb=52649524641775060term%3Dvalue&shadditional=adroll%3Dtrue%2Cgoogletagmanager%3Dtrue%2C
Requested by
Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=https%3A%2F%2Fapps.global.fortinet.com%2F&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&cb=52649524641775060term=value
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.89.99.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-89-99-220.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
aac9227d80c1c98e98bc58b3d868ed3f2de78b4b2bc639f0c0589a2885722bbc

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 25 Feb 2022 20:11:44 GMT
content-encoding
gzip
connection
close
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
content-type
application/javascript;charset=utf-8
collect
d.clarity.ms/ 		0
48 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.clarity.ms/collect
Requested by
Host: d.clarity.ms
URL: https://d.clarity.ms/s/0.6.32/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.fortinet.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin
https://www.fortinet.com
date
Fri, 25 Feb 2022 20:11:43 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
/
p.adsymptotic.com/d/px/ Frame 4C2D
Redirect Chain
  • https://px.ads.linkedin.com/collect/?pid=2159050&conversionId=6504418&fmt=gif
  • https://px4.ads.linkedin.com/collect?pid=2159050&conversionId=6504418&fmt=gif&e_ipv6=AQJ7HxLoxNx6uQAAAX8ygsB0jqEcVbxUpZDBQeoFb4rJLJBzqzVpnU9-89riWoGiBpgC2VrQ
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=62b6be551203d19bdb65cded...
43 B
97 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=62b6be551203d19bdb65cded38963028
Requested by
Host: 10104846.fls.doubleclick.net
URL: https://10104846.fls.doubleclick.net/ddm/fls/r/dc_pre=CNTx3fXUm_YCFUXH4QodrgIGow;src=10104846;type=sitew00;cat=sitew0;u3=https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6383213970243.786;~oref=https://www.fortinet.com/
Protocol
H2
Server
104.18.102.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://10104846.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6e3395a1dde054af-YYZ
p3p
CP='NON DSP COR CONi OUR BUS CNT'
content-type
image/gif
content-length
43

Redirect headers

location
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=49d56f28-9037-40d5-a368-dfc7a3bd5806&_expected_cookie=62b6be551203d19bdb65cded38963028
date
Fri, 25 Feb 2022 20:11:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
6e3395a14d0154af-YYZ
content-length
0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
/
www.facebook.com/tr/ Frame 2A06 		0
15 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
Origin
https://www.fortinet.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/

Response headers

content-type
text/plain
access-control-allow-origin
https://www.fortinet.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
content-length
0
server
proxygen-bolt
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority
u=0
date
Fri, 25 Feb 2022 20:11:44 GMT
gs
gs.mountain.com/ 		144 B
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gs.mountain.com/gs
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
34.212.4.35 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-212-4-35.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
6a897362439c7bb89c089190ab49f2ed3f97b190ea9494faa4b5b0721d1ac2bb

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 20:11:44 GMT
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
istio-envoy
access-control-allow-methods
GET, POST, OPTIONS
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-envoy-upstream-service-time
0
connection
close
content-type
application/javascript;charset=utf-8
access-control-allow-headers
Accept, Content-Type, x-requested-with, X-Custom-Header
content-length
144
x-application-context
application:prod:8080
img.gif
b.6sc.co/v1/beacon/ 		43 B
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=4778ce177a8d0000fe371962ad010000f22a0a00&session=33856b47-f88b-41ab-86ee-0c8d799c02be&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A43%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%222009%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20has%20discovered%20evidence%20that%20the%20Nobelium%20Group%20is%20impersonating%20someone%20associated%20with%20the%20Turkish%20embassy%20as%20a%20lure%20to%20introduce%20a%20Cobalt%20Strike%20beacon%20payload%20and%20gain%20access.%20Read%20our%20blog%20to%20learn%20more.%22%2C%22keywords%22%3A%22Threat%20Research%2Ccybercrime%2CCybersecurity%20Architect%22%2C%22title%22%3A%22Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=https%3A%2F%2Fapps.global.fortinet.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pageViewId=4fab148b-4be9-4055-8112-279ae93ee2be&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.59.105.202 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-59-105-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:44 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
st
px.mountain.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://px.mountain.com/st?ga_tracking_id=UA-767980-1&ga_client_id=1326092565.1645819903&shpt=Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22UA-767980-1%22%2C%22ga_client_id%22%3A%221326092565.1645819903%22%2C%22shpt%22%3A%22Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221326092565.1645819903%22%2C%22dcm_gid%22%3A%22109904114.1645819903%22%2C%22ga_gclid%22%3A%221326092565.1645819903%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A1%2C%22getClientIdByGA%22%3A%22OK%22%2C%22ga_gclid%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%7D%7D&dcm_cid=1326092565.1645819903&dcm_gid=109904114.1645819903&dxver=4.0.0&shaid=32336&tdr=https%3A%2F%2Fapps.global.fortinet.com%2F&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&shadditional=adroll%3Dtrue%2Cgoogletagmanager%3Dtrue%2C&cb=1645819904208626&shguid=4ca044c7-ae5c-30e2-8cb4-7961331124ea&shgts=1645819904524
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.89.99.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-89-99-220.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
c7620e6093e08b0b20369543f9653d8128c7e38dfac91d89c594e1af448f95a4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 25 Feb 2022 20:11:44 GMT
content-encoding
gzip
connection
close
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
content-type
application/javascript;charset=utf-8
tdsync
px.steelhousemedia.com/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=270cfd43-9677-11ec-a8fb-9feab8c30f01&gdpr=&gdpr_consent=
  • https://px.steelhousemedia.com/tdsync?tdid=6efcbacd-059a-41f4-ade0-df1ed7058974&shguid=270cfd43-9677-11ec-a8fb-9feab8c30f01
0
303 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.steelhousemedia.com/tdsync?tdid=6efcbacd-059a-41f4-ade0-df1ed7058974&shguid=270cfd43-9677-11ec-a8fb-9feab8c30f01
Protocol
HTTP/1.1
Server
44.237.157.168 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-237-157-168.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 25 Feb 2022 20:11:45 GMT
connection
close
access-control-allow-headers
Accept, Content-Type, x-requested-with, X-Custom-Header
access-control-allow-methods
GET, POST, OPTIONS
x-application-context
application:awsprod,confluent:9025

Redirect headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:44 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://px.steelhousemedia.com/tdsync?tdid=6efcbacd-059a-41f4-ade0-df1ed7058974&shguid=270cfd43-9677-11ec-a8fb-9feab8c30f01
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
277
generic
match.adsrvr.org/track/cmf/
Redirect Chain
  • https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=6efcbacd-059a-41f4-ade0-df1ed7058974&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=6efcbacd-059a-41f4-ade0-df1ed7058974&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=6efcbacd-059a-41f4-ade0-df1ed7058974
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=1625538908390479308&ttd_tdid=6efcbacd-059a-41f4-ade0-df1ed7058974
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NmVmY2JhY2QtMDU5YS00MWY0LWFkZTAtZGYxZWQ3MDU4OTc0&gdpr=0&gdpr_consent=&ttd_tdid=6efcbacd-059a-41f4-ade0-df1ed...
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=6efcbacd-059a-41f4-ade0-df1ed7058974&google_gid=CAESEOR9XvCooqb9uhhyDIu2hR4&google_cver=1
  • https://tags.bluekai.com/site/5386?id=6efcbacd-059a-41f4-ade0-df1ed7058974&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
70 B
617 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
Protocol
H2
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 25 Feb 2022 20:11:45 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

Location
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
Date
Fri, 25 Feb 2022 20:11:45 GMT
Connection
keep-alive
Content-Length
0
BK-Server
50f
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
img.gif
b.6sc.co/v1/beacon/ 		43 B
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=4778ce177a8d0000fe371962ad010000f22a0a00&session=33856b47-f88b-41ab-86ee-0c8d799c02be&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A44%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223011%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20has%20discovered%20evidence%20that%20the%20Nobelium%20Group%20is%20impersonating%20someone%20associated%20with%20the%20Turkish%20embassy%20as%20a%20lure%20to%20introduce%20a%20Cobalt%20Strike%20beacon%20payload%20and%20gain%20access.%20Read%20our%20blog%20to%20learn%20more.%22%2C%22keywords%22%3A%22Threat%20Research%2Ccybercrime%2CCybersecurity%20Architect%22%2C%22title%22%3A%22Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=https%3A%2F%2Fapps.global.fortinet.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pageViewId=4fab148b-4be9-4055-8112-279ae93ee2be&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.59.105.202 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-59-105-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:45 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
d.clarity.ms/ 		0
48 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.clarity.ms/collect
Requested by
Host: d.clarity.ms
URL: https://d.clarity.ms/s/0.6.32/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.fortinet.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin
https://www.fortinet.com
date
Fri, 25 Feb 2022 20:11:45 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
img.gif
b.6sc.co/v1/beacon/ 		43 B
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=4778ce177a8d0000fe371962ad010000f22a0a00&session=33856b47-f88b-41ab-86ee-0c8d799c02be&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A45%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224013%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20has%20discovered%20evidence%20that%20the%20Nobelium%20Group%20is%20impersonating%20someone%20associated%20with%20the%20Turkish%20embassy%20as%20a%20lure%20to%20introduce%20a%20Cobalt%20Strike%20beacon%20payload%20and%20gain%20access.%20Read%20our%20blog%20to%20learn%20more.%22%2C%22keywords%22%3A%22Threat%20Research%2Ccybercrime%2CCybersecurity%20Architect%22%2C%22title%22%3A%22Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=https%3A%2F%2Fapps.global.fortinet.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pageViewId=4fab148b-4be9-4055-8112-279ae93ee2be&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.59.105.202 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-59-105-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:46 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=4778ce177a8d0000fe371962ad010000f22a0a00&session=33856b47-f88b-41ab-86ee-0c8d799c02be&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A46%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225015%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20has%20discovered%20evidence%20that%20the%20Nobelium%20Group%20is%20impersonating%20someone%20associated%20with%20the%20Turkish%20embassy%20as%20a%20lure%20to%20introduce%20a%20Cobalt%20Strike%20beacon%20payload%20and%20gain%20access.%20Read%20our%20blog%20to%20learn%20more.%22%2C%22keywords%22%3A%22Threat%20Research%2Ccybercrime%2CCybersecurity%20Architect%22%2C%22title%22%3A%22Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=https%3A%2F%2Fapps.global.fortinet.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pageViewId=4fab148b-4be9-4055-8112-279ae93ee2be&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.59.105.202 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-59-105-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:47 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
6si.min.js
j.6sc.co/ 		27 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: apps.global.fortinet.com
URL: https://apps.global.fortinet.com/e/bfs?s=3049749&lguid=fce48e02a40b4260a79e3a1a33f5efc2&elqTrackId=7e2764a45ea74733afde36deeb0ed6c4&elq=0f091f635be94806a559761876f85a77&elqaid=3249&elqat=1&elqCampaignId=22218
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.123.161.196 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-123-161-196.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:47 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
8575
Pragma
no-cache
Last-Modified
Thu, 07 Oct 2021 17:17:43 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615f2bb7-6a5f"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Cache-Control
private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Fri, 25 Feb 2022 20:11:47 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=4778ce177a8d0000fe371962ad010000f22a0a00&session=33856b47-f88b-41ab-86ee-0c8d799c02be&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A47%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%226020%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20has%20discovered%20evidence%20that%20the%20Nobelium%20Group%20is%20impersonating%20someone%20associated%20with%20the%20Turkish%20embassy%20as%20a%20lure%20to%20introduce%20a%20Cobalt%20Strike%20beacon%20payload%20and%20gain%20access.%20Read%20our%20blog%20to%20learn%20more.%22%2C%22keywords%22%3A%22Threat%20Research%2Ccybercrime%2CCybersecurity%20Architect%22%2C%22title%22%3A%22Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=https%3A%2F%2Fapps.global.fortinet.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pageViewId=4fab148b-4be9-4055-8112-279ae93ee2be&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.59.105.202 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-59-105-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:48 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=4778ce177a8d0000fe371962ad010000f22a0a00&session=33856b47-f88b-41ab-86ee-0c8d799c02be&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2025%20Feb%202022%2020%3A11%3A48%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%227023%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20has%20discovered%20evidence%20that%20the%20Nobelium%20Group%20is%20impersonating%20someone%20associated%20with%20the%20Turkish%20embassy%20as%20a%20lure%20to%20introduce%20a%20Cobalt%20Strike%20beacon%20payload%20and%20gain%20access.%20Read%20our%20blog%20to%20learn%20more.%22%2C%22keywords%22%3A%22Threat%20Research%2Ccybercrime%2CCybersecurity%20Architect%22%2C%22title%22%3A%22Nobelium%20Returns%20to%20the%20Political%20World%20Stage%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=https%3A%2F%2Fapps.global.fortinet.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&pageViewId=4fab148b-4be9-4055-8112-279ae93ee2be&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.59.105.202 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-59-105-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.fortinet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 25 Feb 2022 20:11:49 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

198 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 function| structuredClone object| OneTrustStub string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer function| OptanonWrapper object| otStubData object| Optanon object| OneTrust object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| setImmediate function| clearImmediate function| $ function| jQuery object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in number| timer_e function| obApi object| _6si object| uetq function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq function| UET function| UET_init function| UET_push object| ueto_a31a299dcb boolean| _storagePopulated function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto boolean| __@@##MUH function| clarity function| OptinMonsterApp boolean| om_loaded object| om45602_39852 boolean| _omvisitsadded function| omq string| adroll_adv_id string| adroll_pix_id function| hj object| _hjSettings string| wid_baseUrl object| wid_cmds function| gtag object| cookieScriptWindow object| cookieScripts string| cookieScriptDomain number| cookieScriptDebug boolean| cookieScriptShowBadge string| cookieScriptCurrentUrl string| pagePath string| ftntCampaign function| updateCampaignCookie function| ftntInjectCookieScript function| ftntCookieScriptCreateCookie function| ftntCookieScriptReadCookie object| _omapp object| omb2dxtopzidsdt3fkzfsv object| omqbkzwxxbiv83f0ol5a2d object| omtd4yyupw30z3kaz7uhys object| ombs6hw8oho0l8z5lmhzmv object| omqxx1b0gslklfu2kjckea object| omtaoi2gud8wo2ip9kbnpv object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData function| fbAsyncInit object| _omns object| s_i_fortinetincproduction string| WID_VISITOR_ID string| WID_EVENT_TYPES string| WID_PAGE_TITLE string| WID_PAGE_URL string| WID_PAGE_REFERAL_URL number| WID_INTERVAL number| WID_IDLE_INTERVAL undefined| po undefined| s function| wid_initAgain function| wid_handleAnchorClick function| wid_bundleParams function| wid_handleApiRequest function| wid_handleButtonClick function| wid_findParentByTagName function| wid_getCurrentUnixTimestamp function| wid_getCookie function| wid_setCookie function| wid_deleteCookie function| wid_generateRandomGuid function| wid_zeroFill function| wid_str_pad function| wid_rand object| t boolean| __adroll_loaded string| _linkedin_data_partner_id object| _ml function| twq function| fbq function| _fbq string| mlId string| axel number| a string| adroll_sid object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks undefined| adroll_tpc_callback object| twttr function| __cmp function| __tcfapi object| adroll_exp_list function| lintrk boolean| _already_called_lintrk function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| __adroll_consent_data string| dcm_cid undefined| dcm_tid undefined| dcm_gid boolean| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country object| adroll_currency object| adroll_conversion_value object| adroll_conversion_value_in_dollars string| adroll_seg_eid string| adroll_rule_type object| irongate

113 Cookies

Domain/Path Name / Value
site.fortinet.com/utilservice Name: JSESSIONID
Value: 7D23EE3F15D75A2C31C2E65699507D97
.fortinet.com/ Name: ELOQUA
Value: GUID=1ACA1CDB7CEA435ABA795BB508A19C43
.fortinet.com/ Name: ELQSTATUS
Value: OK
www.fortinet.com/ Name: cookiesession1
Value: 678A3E9A218EAB0F3FFC70A31560EC14
.fortinet.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Fri+Feb+25+2022+20%3A11%3A42+GMT%2B0000+(GMT)&version=6.10.0&hosts=&consentId=b8b753c0-5c1a-49c8-8301-4c8224394f4e&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.6sc.co/ Name: 6suuid
Value: 4778ce177a8d0000fe371962ad010000f22a0a00
.bing.com/ Name: MUID
Value: 0309D56B7F296E6E3B61C43D7E836FED
.bat.bing.com/ Name: MR
Value: 0
.fortinet.com/ Name: _uetsid
Value: 26054030967711ec8446d77447d305c8
.fortinet.com/ Name: _uetvid
Value: 260551f0967711ec942b13069f79c218
www.fortinet.com/ Name: _gd_svisitor
Value: 4778ce177a8d0000fe371962ad010000f22a0a00
www.fortinet.com/ Name: _an_uid
Value: 0
www.fortinet.com/ Name: _gd_visitor
Value: 3f563a9c-894b-4e65-8c0d-4a172a6ca809
www.fortinet.com/ Name: _gd_session
Value: 33856b47-f88b-41ab-86ee-0c8d799c02be
www.fortinet.com/ Name: outbrain_cid_fetch
Value: true
.demdex.net/ Name: demdex
Value: 32320825144907041532078492508500204060
www.fortinet.com/ Name: _omappvp
Value: zwrZpSo81mFd06iYQJ2IKX7TejmxrcmNzgVMQwDktEpfG3jyRUm3tVDQGkQWNGZk7djEVqIZD03MV71iobOL0mH2iZb6pAM4
www.fortinet.com/ Name: _omappvs
Value: 1645819902788
.fortinet.com/ Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg
Value: 1
.fortinet.com/ Name: _clck
Value: 5128fi|1|eza|0
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 0309D56B7F296E6E3B61C43D7E836FED
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~Yhk3-gAAAHM3uQPl
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 0309D56B7F296E6E3B61C43D7E836FED
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0
.fortinet.com/ Name: _ga
Value: GA1.2.1326092565.1645819903
.fortinet.com/ Name: _gid
Value: GA1.2.109904114.1645819903
.fortinet.com/ Name: _gat_gtag_UA_767980_1
Value: 1
.dpm.demdex.net/ Name: dpm
Value: 32320825144907041532078492508500204060
.fortinet.com/ Name: _clsk
Value: 1u4y9de|1645819903042|1|1|d.clarity.ms/collect
.fortinet.com/ Name: _hjSessionUser_1178304
Value: eyJpZCI6ImQ2NTQ3ZjlhLWI5MzMtNWIzMS1iMzVkLTYwYmI3MTFlMjA5ZSIsImNyZWF0ZWQiOjE2NDU4MTk5MDI5OTksImV4aXN0aW5nIjpmYWxzZX0=
.fortinet.com/ Name: _hjFirstSeen
Value: 1
www.fortinet.com/ Name: _hjIncludedInSessionSample
Value: 0
.fortinet.com/ Name: _hjSession_1178304
Value: eyJpZCI6ImEzMzYwNjhiLTNkMTktNDNkYi1iNjJhLTZhMDVkN2I4ODliYSIsImNyZWF0ZWQiOjE2NDU4MTk5MDMwNDcsImluU2FtcGxlIjpmYWxzZX0=
.fortinet.com/ Name: _hjAbsoluteSessionInProgress
Value: 0
www.fortinet.com/ Name: omSeen-qxx1b0gslklfu2kjckea
Value: 1645819903091
.fortinet.com/ Name: s_ecid
Value: MCMID%7C31965837187116156332044189977076906900
.fortinet.com/ Name: gpv_pn
Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fnobelium-returns-to-the-political-world-stage
.fortinet.com/ Name: s_cc
Value: true
.fortinet.com/ Name: s_getNewRepeat
Value: 1645819903126-New
.fortinet.com/ Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg
Value: -2121179033%7CMCIDTS%7C19049%7CMCMID%7C31965837187116156332044189977076906900%7CMCAAMLH-1646424702%7C9%7CMCAAMB-1646424702%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1645827103s%7CNONE%7CMCSYNCSOP%7C411-19056%7CMCAID%7CNONE%7CvVersion%7C5.3.0
.fortinet.com/ Name: cus_ref_1
Value: apps.global.fortinet.com%2F
www.fortinet.com/ Name: WID_VISITOR_ID
Value: 1645819903149090283
.fortinet.com/ Name: _gcl_au
Value: 1.1.225814359.1645819904
site.fortinet.com/ Name: cookiesession1
Value: 678B2875PQRSTUVWXYZABCEFGJKL11B9
.fortinet.com/ Name: aa_cc
Value: CA
.fortinet.com/ Name: aa_cn
Value: Canada
.fortinet.com/ Name: _fbp
Value: fb.1.1645819903700.1440365010
.twitter.com/ Name: personalization_id
Value: "v1_HIrEv4s6B+C573fEfjeu7w=="
.t.co/ Name: muc_ads
Value: cb581038-9f3b-4d57-82f8-fed9c7cc5b54
.linkedin.com/ Name: li_sugr
Value: 49d56f28-9037-40d5-a368-dfc7a3bd5806
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&225ced29-aaca-4a5f-86e0-b7f3adc6e0c9"
.doubleclick.net/ Name: IDE
Value: AHWqTUnI2yEWGmguS-CLQNqWglSClAla2WRgH0B6C3w1t3jRuPCP1SnWWuZfTa4J
.facebook.com/ Name: fr
Value: 0oZYF5FXm9Dnt0Bpa..BiGTf_...1.0.BiGTf_.
.www.fortinet.com/ Name: __adroll_fpc
Value: 5ad8fc2f0f3b444db980e10955d5734a-1645819903811
.linkedin.com/ Name: UserMatchHistory
Value: AQLpM58S0YizjgAAAX8ygr86P1602R-00cw3fMPc-rxjDuFG9AP3gmgSd2vuVEHRkjpa6rq7HxVy_Q
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKr3rah0qGgkgAAAX8ygr86qcnerNm_VpTW3Faxm-3KXDbWBvAxG_bD0gw7FNjaaiJHQy--wADPo-tN5mUoWA
.ml314.com/ Name: pi
Value: 3625396256698794042
.ml314.com/ Name: tp
Value: 4%3b2%2f25%2f2022+3%3a11%3a43+PM%3b0
.www.fortinet.com/ Name: __ar_v4
Value: %7C7OBVBCAQE5FHDPFEAD5T4D%3A20220227%3A1%7CGIVUJ77KRNF4LOPGYJ6RS5%3A20220227%3A1%7CVGLVDYA6GRASZMUSTHUV5D%3A20220227%3A1
.adsrvr.org/ Name: TDID
Value: 6efcbacd-059a-41f4-ade0-df1ed7058974
.eyeota.net/ Name: mako_uid
Value: 17f3282bfca-7feb0000010a483f
.eyeota.net/ Name: SERVERID
Value: 18495~DM
.ml314.com/ Name: u
Value: aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLw==
.openx.net/ Name: i
Value: 081e2426-2062-4bf4-800d-3d1260bd84e5|1645819903
.advertising.com/ Name: APID
Value: UP26e99781-9677-11ec-b0b6-0aa04754be25
.adnxs.com/ Name: uuid2
Value: 1625538908390479308
.taboola.com/ Name: t_gid
Value: 692cf559-ccd0-4c4d-959d-0c99be82952b-tuct912bd7f
.pubmatic.com/ Name: KRTBCOOKIE_10
Value: 22808-NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI&KRTB&22883-NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
.pubmatic.com/ Name: PugT
Value: 1645819903
.pubmatic.com/ Name: PUBMDCID
Value: 2
.outbrain.com/ Name: obuid
Value: 2dcd6039-377a-4dc0-a23f-2f5571993856
.outbrain.com/ Name: adrl
Value: NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
.3lift.com/ Name: tluid
Value: 460621003236039605150
.adnxs.com/ Name: anj
Value: dTM7k!M4/rD>6NRF']wIg2InAwqOoZ!]tbPl@/@8$-^=$UfY:KAHm-NC^6=M^G[rBZmvXWAKGeg=!6+l^Es+HIg26kE@m*z]/4gyZsnC/>J@??3If)y3KL9D3I?+/f[5t7
.rubiconproject.com/ Name: khaos
Value: L02UODFI-5-2BKN
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.crwdcntrl.net/ Name: _cc_id
Value: ccd222cbcfd591bd250aee60c572d50c
.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.www.linkedin.com/ Name: bscookie
Value: "v=1&20220225201143d26e6ae8-54f3-4e0d-8519-3576ea68e48aAQHxbNeWrFD_BXFpXpsO4KGwhbpq6AfW"
.bidswitch.net/ Name: tuuid
Value: 68fb2f87-0149-4c4a-8e71-f6372df43dd7
.bidswitch.net/ Name: c
Value: 1645819904
.bidswitch.net/ Name: tuuid_lu
Value: 1645819904
d.adroll.com/ Name: __adroll
Value: 5efecbec43b83ea17f137a72ff33182b-g_1645819904-a_1645819903
.adroll.com/ Name: __adroll_shared
Value: 5efecbec43b83ea17f137a72ff33182b-g_1645819904-a_1645819903
.rlcdn.com/ Name: rlas3
Value: BgWE7jKCwmjpTm3e6R76faTMzg/ZmUsGtt71UVih3ec=
.rlcdn.com/ Name: pxrc
Value: CIDw5JAGEgUI6AcQABIFCOhHEAA=
.yahoo.com/ Name: A3
Value: d=AQABBAA4GWICEF-w5mSI649egWtwbWuhDjgFEgEBAQGJGmIjYgAAAAAA_eMAAA&S=AQAAAuunqEO8FkdndEYfUVqSs5E
.linkedin.com/ Name: lidc
Value: "b=VGST01:s=V:r=V:a=V:p=V:g=2547:u=1:x=1:i=1645819904:t=1645906304:v=2:sig=AQGHdbq2nnj-qXmomW8d_OEBHxwyCy92"
.analytics.yahoo.com/ Name: IDSYNC
Value: 1770~23fw
.pippio.com/ Name: did
Value: dkARYAdi7lAEDprX
.pippio.com/ Name: didts
Value: 1645819904
.pippio.com/ Name: nnls
Value:
.casalemedia.com/ Name: CMID
Value: Yhk4AHse4hyhqcFyV46zJQAA
.casalemedia.com/ Name: CMPS
Value: 465
.pippio.com/ Name: pxrc
Value: CIDw5JAGEgQIAhAAEgYI7OsBEAA=
.mountain.com/ Name: guid
Value: 270cfd43-9677-11ec-a8fb-9feab8c30f01
.casalemedia.com/ Name: CMPRO
Value: 479
.casalemedia.com/ Name: CMRUM3
Value: 69621938002760NWVmZWNiZWM0M2I4M2VhMTdmMTM3YTcyZmYzMzE4MmI
.casalemedia.com/ Name: CMST
Value: Yhk4AGIZOAAA
.linksynergy.com/ Name: rmuid
Value: 2816a7a3-0f9b-4521-9cfe-0c88284230c0
.linksynergy.com/ Name: icts
Value: 2022-02-25T20:11:44Z
.adsymptotic.com/ Name: U
Value: 62b6be551203d19bdb65cded38963028
.px.mountain.com/ Name: tt
Value: "H4sIAAAAAAAAAKtW8guKNzYyNjaLNzK3NFayMtBRgnItjC2UrAzNTEwtDC0tDUzMzYBSZUpWRjpIWsBqDGoBdU9b+0YAAAA="
.mountain.com/ Name: rt
Value: "MzIzMzY6MTY0NTgxOTkwNA=="
.rubiconproject.com/ Name: audit
Value: 1|Cv2Ufubz4NOqAFLZEQehPqnCToPn3Csf9JwTPQSgjsXWaDs14xzbSOyE5WBA2P1CMLPjwV0VlTuM1KxoLazIt7kxm0k08nop+R4DB+iLIkEWFdGr1LuDtb65Jk+a7G+0gXH2QouK/iyDPiQQ2jRUytDP2e+lDg+kxwEUqjDya7biI1rGpJxwaA5/8Wu8VjpS3TYsX/cuoqHQD5U7tEfUTQ==
.bluekai.com/ Name: bkdc
Value: phx
.bluekai.com/ Name: bkpa
Value: KJy5iaLvQp9x9WIEdAPMTd1MkWnhsCJlBh3Lepqq7gIC11p9kYAvkRl+t65WNNv9txB36yhKNNVG+Dz0sABatJZZcfgb+reapFypyUAAmLE5ZeY0V6VromhElz41fQUVyZwinhz7nlAJK2C0RxdjYhlWWjx5HUYb/igfZ+X4t7pX9P+x15/=
.bluekai.com/ Name: bku
Value: YCD999WTsVJC+BR0
.adsrvr.org/ Name: TDCPM
Value: CAESFgoHZDB0cm8xahILCOjq6rWiqbw6EAUSEgoDYWFtEgsI8JjK3uj2sDoQBRIWCgdydWJpY29uEgsIypewv6KpvDoQBRIXCghhcHBuZXh1cxILCPbyhsCiqbw6EAUSFQoGZ29vZ2xlEgsItKnmwKKpvDoQBRIWCgdibHVla2FpEgsItKnmwKKpvDoQBRgFOAFCBCICCAE.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
a.omappapi.com
a.opmnstr.com
ads.yahoo.com
adservice.google.ca
adservice.google.com
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
apps.global.fortinet.com
argusplatform.com
assets.adobedtm.com
b.6sc.co
bat.bing.com
c.6sc.co
c.bing.com
c.clarity.ms
cdn.cookielaw.org
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
d.adroll.com
d.clarity.ms
dpm.demdex.net
dsum-sec.casalemedia.com
dx.mountain.com
eb2.3lift.com
epsilon.6sense.com
fortinet.demdex.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
ib.adnxs.com
idsync.rlcdn.com
image2.pubmatic.com
insight.adsrvr.org
j.6sc.co
match.adsrvr.org
metrics.fortinet.com
ml314.com
p.adsymptotic.com
pippio.com
pixel.advertising.com
pixel.rubiconproject.com
pixels.argusplatform.com
ps.eyeota.net
px.ads.linkedin.com
px.mountain.com
px.steelhousemedia.com
px4.ads.linkedin.com
s.adroll.com
s7.addthis.com
script.hotjar.com
secure.adnxs.com
site.fortinet.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
sync.crwdcntrl.net
sync.outbrain.com
sync.taboola.com
t.co
tags.bluekai.com
tags.rd.linksynergy.com
tr.outbrain.com
ups.analytics.yahoo.com
us-u.openx.net
vars.hotjar.com
www.argusplatform.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
x.bidswitch.net
z.moatads.com
104.123.161.196
104.18.102.194
104.244.42.3
104.244.42.69
107.178.254.65
108.174.10.24
13.225.230.103
13.225.230.122
13.225.230.126
13.225.230.39
141.226.224.48
142.0.160.14
142.250.65.162
142.250.80.34
142.250.80.38
146.75.28.157
195.181.168.47
20.36.253.92
2001:4998:14:800::1001
23.195.108.126
23.200.173.135
23.59.105.202
23.62.212.240
23.62.213.139
23.62.213.74
2600:141b:13::17d7:825a
2600:141b:e800:1192::1e80
2600:9000:21ec:1a00:6:9280:1080:93a1
2606:4700:10::6814:b844
2606:4700::6810:9440
2607:f8b0:4006:80c::2002
2607:f8b0:4006:80d::2002
2607:f8b0:4006:80d::2004
2607:f8b0:4006:80e::2003
2607:f8b0:4006:80e::2008
2607:f8b0:4006:820::200e
2607:f8b0:4006:824::2002
2620:1ec:21::14
2620:1ec:c11::200
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
3.208.223.190
3.218.90.66
3.91.211.14
34.212.4.35
34.251.139.24
34.98.64.218
34.98.67.3
35.162.68.238
35.190.60.146
35.211.178.172
35.71.139.29
37.19.206.70
40.76.174.66
44.237.157.168
50.16.69.23
52.21.103.83
52.223.40.198
52.7.36.46
52.88.252.250
52.89.99.220
54.154.189.86
54.156.26.12
54.208.50.252
54.212.155.93
54.69.255.140
54.89.1.168
68.67.160.114
68.67.179.166
69.173.151.100
70.42.32.223
70.42.32.31
8.28.7.83
96.45.36.159
0055b9d0429e9c194b4aa6b5f49cbc2ec31a7220ee7c8c186a9ee951feabd482
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
055e467aa53a9c0272d805bbc009ade8c74df5a8c1255271d753ac78fe179873
09b8e25d8cb3cefc967aa2d7026ca52211875c9d02a3051dc7a9383442003a26
0cc212f18665e9c7c0da9aa9e47a1561339359db5474e985db999f0950a0ca97
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11816a0873ff77d255f6be4dceaede153ca3a3d4990100554dc1c5f61a934a06
1280aaeef25bfb5b1b64c921ec4a505f623678c64a8e132552a3f00796933262
134482ec36c8980c2c7a3f2454c76546abcd612c9ae596d011251a7cd1d0fcbb
134568be83d33ab28a55e78e8e8ac638ac6a57ff1bfc62bb5bc4e93fee39e20f
154130f3cc3a91c2dcdec666bebfc5e5a2ca6c80ecd2fd792a508d09626b5840
1646e8a67bdf74190ba70cce752d0949795b2aab98336953114405e2f60e2ffb
175f90d7fb29bcf11a50b8555345fda4068908c88c5c55e33f6a52e18184a774
1ad1bc201badad52b9cfe16df478ba99053aef36ba4b5d457943a45bd6bb1d8e
1bded02879e2df34de7df88fc7dd7b325a01a4fbc5af6d0877d5e3364c23ce49
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1e1a42cb75ebd81eb31850e485ef4c6e3667a45f57f778f249bca1f2852a97e4
1fd9a00fd5df278e713e45375b2c46517c7d254ad6cf356f7d4b996b1f636982
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
27a477c91992ade903773347f50b15bea9d3d6b540b50362dbdebe371f3ba879
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
2fa0eafa106eed3ad7922c6bc544582f2747ad19dd687fc649cda243a1cd360e
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
32e3eede21caea5ec1a99bdf52568e1dc98035ec955b0f06386d1dac0d609666
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
34c51c6df81406b38dad24d92f1dc72609faf576f40e175a3a491d4f58edef20
366ceeddfa3f83d84507dae95e949f01db7164d10b0f6cd23790816fb5861ad6
3701cadc5fc84e8ad639f83a87e20d82575e3cc28d479d73a0e66e5230e71c65
39308a396e97df42bc3699b37ef93a00e6458765ba4e43291eb320e8bf24ed01
41f1e9970b646aadac0f40543bb08b21e49990bf1b09392d1ef4d71b275069ea
42aba085cf8c8649680fcc508c922d3d3774fdac968af608b118c9b75292c0a2
430260c1e98c636f2a9d13d7d4e159083abe889eaf5a58530dd779862ca32404
46f72f8df104a00bc87acd732b098046f71aca9ce1b7bf87fa3a766b8ff46f73
484894648719027fc265a9fad98eddfe18cee179cde0e98b780af731e6b30a4a
4925a85c1723e81894735b3c86dc169ed7fd10388ecf0f536a182336cfa660e8
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f828cdeddc7cc8061dfb2bed5d92c0cca701df32f7b1bc0273c01cbde623314
507ce7426c190c3d954909e634c514914c57d3f311fc022b560260614b596196
5131187204ce9efe08b945d15633d7d418fd692999f824f9a55524aa95559fea
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
56be370775b0003fada1092da069ec70c1a1c1e6b9395e85301a3e059b454767
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
632f0f84c55593d43d3a8a5b38e848796f8d3cf0f643a130d0e27a8055d0fa98
6a18b3c0a15fab8498292821e96772658557a7812cd0d2c34f2f73e0081f8c09
6a897362439c7bb89c089190ab49f2ed3f97b190ea9494faa4b5b0721d1ac2bb
6b6c67f54c9cae9226b2251489f4604e72a15890c09e4cab3f7686fbc6c42ace
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bdeca02f38306151b71374cfbbbe73506a9af54f4e3a5d9f6c04a969ada3e1a
6cf987ab9ebb5a9e4fdc85b52ce610e1fc1cac645d71255d227f3393bf16cff7
7020be4e3541c91f5c6eae33141472969e2af8975ff47d596dfbe7e9c5eff660
7229e3742e4e2024c384f75f57b55f157ec9484b3ee76eb6bfa2381ad0a130f4
72cca376440f971e2d99e3f8b7a50432517e8a75327360d35a3df8b896c3962d
74b1612d1cb16d432cfd6542a7efe8f9297f1197025e044b9e0d9fa8e54befab
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
7a845344c57ceb50d3a4656048eac82130caded56be394b3d5bea83516775ac4
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7caf8b3b05dece083ff18c992c35b56ce60d853758ecd4ff805e1614233e1248
7dd370e6f3c7479b2e8b0c4e2e4965fb0dc2ca9ce2a541cc0624b069b062471a
7e8ef05a55eafab5277e6449520107db94dfb01b497a52f283e7ffa6ee49363d
7ec050c22e54c97b896f3196057dd010e45c580fe6ca44c91e2e3a513730494f
812dbd37a9a9179ba0a674e7abc70b8f7a6af672a31605b49977d8cdfff8c1a7
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
8cdca3b36914e8a3f56390da71389944579faaae82704e53bd66f9c0387502f6
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8eb5d5a80b01da6441ef887899a0b088728b9ef621054a97c14fc889f69aee54
9213e89897982f211a9055c3337ac2f00726e2d64489ea99f5173fb572a946d5
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9b3a768a0d2d23e86f3887b0b40ef0b35c39589dd4e9cac28adf957c045cfca3
9ca6e1bd00d52bdaa9899a8c8c87af7ebc4b65528cca3f4e200672814d5bf75f
9fc340f3124536c401070981407bf671cd21dbed9ecd311bc9ad6e03715848f1
9ffb8f3aec546bb06d1c4635ba17d29bf85c06c952e153034dae313250cbb829
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a334f368b502d68bcaafb174022cfe21775f1744f0a1cd520d0c57d094a8e66a
a5fcefaba919e6115c4d7ed76d1ea94529a8ca0c00e555ce93b075b290df99ff
aac9227d80c1c98e98bc58b3d868ed3f2de78b4b2bc639f0c0589a2885722bbc
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
b0c70f9d21afd60b58ce1fea2625adbfa52135ea789949426309bd1defec5872
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b175564106ad5e553a2e98b8e44e8c10c8d7bf8e48886001d85d6a6583763439
b2545a170d38773dd41af8afa2c638580819811ec293586d4b7045daa394ca22
b399694d43775ea7757674996d3a5f466ea7afbe492ff90617595a12dadc4b58
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bbf4d111477ba98c1f74a84ec0a2b7d5712f35bd6fbe2b388f5cb3f2f6c7a7d1
c6cebb694e1b4a62ee0ddcf1d387ed1b92b755ff2294460f4757498eaff1a749
c73f24ae3ba3968a628f797e9f78ea2694531ff2bde63a116d9ea1ffc58e4597
c7620e6093e08b0b20369543f9653d8128c7e38dfac91d89c594e1af448f95a4
cae0ae2d67aac89367108586ebd25e00afc5d0f8110e6eb71b8d274037f7a5d8
cc6d6ba4009e5b68c04afbbc9e0a8228a264e32047c2658a6d55d122072a8295
cd5489dc88fd8e9e9ea9cacf8077f8b20446d10fab97186491fe62079051a10d
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d3f7b36acf8eb6845a2eb64c1cd115acf2c4c73cb81b64d968873d52528a6c66
d4e77c7411d1de6efebf4278b9c98aa77dc2e5186cee271ac256138f17bef9f4
d62a3b924d49cc3909d8c7e7d66c6fda8780c357fae0f927993f424928401b20
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e0f23d16bb40b894855d19e097cc0b9f4695b98a7db1fed18625cfb1ce8bda35
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea110358a3d9ed8f3e493e104b3e523e51b27653837899f2139762521ad1001c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5975a6c757aab157ba24a9a879798eb43c75380a87e421a4d8e3bec8a85991e
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f83ca3e8299ce52ab2282f283eccd64729dda06b0f32a47959a4f10ff14ef9a1
f87c3386ed26d681a833078b5a6f3fcf5e7495dc57d70aba7be783a0fc2f70a1
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fdfa3be46a0709e1b7d4af2cc96487fa867f2db7065bcc2663b0ae446e675ccb
fed1a9fa30680dad50553270e1776c0c7db7b90ea6dac3373e1e77294af21399
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3