www.fortinet.com Open in urlscan Pro
3.123.216.247  Public Scan

12 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

36 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request phishing-campaign-delivering-fileless-malware Show response www.fortinet.com/blog/threat-research/	51 KB 18 KB	759ms 620ms	Document text/html	3.123.216.247 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-123-216-247.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash d08b9e4bf559a556a6614e76d5df29666e205a904e998d10d87bbca4c756b5f5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Cache-Control max-age=600, public Connection keep-alive Content-Encoding gzip Content-Length 17900 Content-Type text/html;charset=utf-8 Date Wed, 18 May 2022 10:39:36 GMT ETag "ca80-5df3cf1838099-gzip" Last-Modified Tue, 17 May 2022 22:48:46 GMT Server Apache Strict-Transport-Security max-age=31536000; includeSubDomains Vary Accept-Encoding,User-Agent X-Content-Type-Options nosniff X-Dispatcher dispatcher1uswest1 X-Frame-Options SAMEORIGIN X-Vhost publish X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	clientlib-base.min.css www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/	217 KB 27 KB	164ms 163ms	Stylesheet text/css	3.123.216.247 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css?v=1 Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-123-216-247.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 9af0506f7d0221d9049280d06c6af4bc060a54a9657bbdef66bc3e85b8d00904 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 18 May 2022 10:39:36 GMT Content-Encoding gzip X-Content-Type-Options nosniff X-Vhost publish Connection keep-alive Vary Accept-Encoding,User-Agent Content-Length 27089 X-XSS-Protection 1; mode=block Last-Modified Fri, 29 Apr 2022 21:06:27 GMT Server Apache X-Frame-Options SAMEORIGIN ETag "3628c-5ddd16a6d3ac0-gzip" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type text/css;charset=utf-8 Cache-Control max-age=684000, public Accept-Ranges bytes
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	20 KB 7 KB	66ms 27ms	Script application/javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 03aa6fcac2902227e1b66a01b87824692f708bbf9bfe441784f8ed22d677f6de Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 18 May 2022 10:39:36 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 +q2Bd0SvXowDeesSOf+0yw== age 10369 vary Accept-Encoding content-length 6782 x-ms-lease-status unlocked last-modified Tue, 17 May 2022 16:31:29 GMT server cloudflare etag 0x8DA3822B23D0DE9 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id d4700742-d01e-00d7-241e-6a92c1000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70d3f84efd7f9085-FRA
GET H2	200	marvel.js Show response marvel-b2-cdn.bc0a.com/	9 KB 4 KB	106ms 33ms	Script application/javascript	35.201.125.192 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://marvel-b2-cdn.bc0a.com/marvel.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.201.125.192 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 192.125.201.35.bc.googleusercontent.com Software UploadServer / Resource Hash 965fc05b277596a937ba9d14388799fd5217eb96179f0187b8b937347bdfaf59 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Wed, 18 May 2022 10:15:16 GMT content-encoding gzip age 1460 x-guploader-uploadid ADPycduXCuoyq9gN4zN1TUrsbgotktugTlxNSi9JMP1S_Pynf0-YxX159Gk3CfNrKwhNxC_i78SgNGs4hGkVRJwGIbYTIKIrcpgR x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 2 x-goog-stored-content-encoding gzip alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3217 last-modified Wed, 01 Sep 2021 18:16:49 GMT server UploadServer etag "5a385b6f8bc7f4775b2ec7b66c0ec4c2" vary Accept-Encoding x-goog-hash crc32c=0X9o7A==, md5=Wjhbb4vH9HdbLse2bA7Ewg== content-language en access-control-allow-origin * x-goog-generation 1630520209881243 access-control-expose-headers Content-Type cache-control public, max-age=3600 x-goog-stored-content-length 3217 accept-ranges bytes content-type application/javascript expires Wed, 18 May 2022 11:15:16 GMT
GET H/1.1	200 OK	fortinet-logo-white.svg www.fortinet.com/content/dam/fortinet-blog/	32 KB 3 KB	163ms 163ms	Image image/svg+xml	3.123.216.247 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-123-216-247.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 18 May 2022 10:39:37 GMT Content-Encoding gzip X-Content-Type-Options nosniff X-Vhost publish Content-Disposition attachment; filename="fortinet-logo-white.svg" Connection keep-alive Vary Accept-Encoding,User-Agent Content-Length 1998 X-XSS-Protection 1; mode=block Last-Modified Thu, 22 Feb 2018 23:16:01 GMT Server Apache X-Frame-Options SAMEORIGIN ETag "7ebb-565d53a1d6e40-gzip" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type image/svg+xml Cache-Control max-age=684000, public Accept-Ranges bytes
GET H/1.1	200 OK	clientlib-base.min.js Show response www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/	150 KB 69 KB	948ms 926ms	Script application/javascript	3.123.216.247 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-123-216-247.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 1e1a42cb75ebd81eb31850e485ef4c6e3667a45f57f778f249bca1f2852a97e4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 18 May 2022 10:39:37 GMT Content-Encoding gzip X-Content-Type-Options nosniff X-Vhost publish Connection keep-alive Vary Accept-Encoding,User-Agent Content-Length 70015 X-XSS-Protection 1; mode=block Last-Modified Thu, 14 Jan 2021 20:20:55 GMT Server Apache X-Frame-Options SAMEORIGIN ETag "25644-5b8e1fe2bf7c0-gzip" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type application/javascript;charset=utf-8 Cache-Control max-age=684000, public Accept-Ranges bytes
GET H2	200	f85f39fc-d7aa-467a-b762-fbb722748016.json Show response cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/	4 KB 2 KB	34ms 19ms	XHR application/x-javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a334f368b502d68bcaafb174022cfe21775f1744f0a1cd520d0c57d094a8e66a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 18 May 2022 10:39:36 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 ypNp2Paf3c+p42YUXiXMnA== age 1115 vary Accept-Encoding content-length 1413 x-ms-lease-status unlocked last-modified Fri, 12 Feb 2021 00:26:33 GMT server cloudflare etag 0x8D8CEECD9FE5833 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id d7947599-501e-00ab-3ecf-110ff4000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70d3f84fed6e9273-FRA expires Wed, 18 May 2022 14:39:36 GMT
GET DATA	200 OK	truncated /	71 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type image/png
GET H2	200	phishing-bitrat-pandora-part-one-hero.jpg marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/	38 KB 38 KB	124ms 79ms	Image image/webp	2600:9000:21f3:9a00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/phishing-bitrat-pandora-part-one-hero.jpg Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:9a00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 57ca15ddb2fd45861fd4414dd2e205297188620cddb44b316c497c3f2c104d04 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id 1LGhphIgslTYhsMhATmml4SJRgcDpmcz via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) etag "64aec2d0e7851def1e9c69f238f17ffd" age 13259 x-cache Hit from cloudfront x-amz-request-id CJZWSS6CGYDSKX90 x-amz-id-2 SQpeB/Ifc0wR8OKE7PUPGMDFfNm0C0FpylK7oesbSU1zyBfTwue4g8f/Zk+qRHvoNigsLU4aH1E= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:39 GMT server AmazonS3 date Wed, 18 May 2022 06:58:39 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA2-C2 content-length 38714 x-amz-cf-id -vmmPc-Ihi9bDEfMd6hofMPcRc8nD2Rf_jPhRMUpWa8VasKzFgtR8Q==
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	182 B 457 B	50ms 24ms	XHR application/json	2606:4700:10::6814:b944 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept application/json Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Wed, 18 May 2022 10:39:37 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET, OPTIONS content-type application/json access-control-allow-origin * strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 70d3f8503a609070-FRA access-control-allow-headers Content-Type
GET H2	200	what-s-cooking-dridex-s-new-and-undiscovered-recipes.png.thumb.319.319.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/	5 KB 6 KB	58ms 34ms	Image image/webp	2600:9000:21f3:9a00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/what-s-cooking-dridex-s-new-and-undiscovered-recipes.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:9a00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e9d0dce3bffb12ae344ee055850d36f892c0c00f5e3d3975bd71970288fcc35d Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Wed, 18 May 2022 04:53:57 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) age 20741 x-cache Hit from cloudfront x-amz-request-id 1ENTBJ4N3H677M32 x-amz-id-2 apzIjlmIUwnnnam2Uuf6CplWbg+nT7lPvlcC6IFDzLjas3MCyERfEWvJtxFipZzUiovdl7S82X8= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:38 GMT server AmazonS3 etag "68bd98881d9b8a939de22d56665954d9" x-amz-version-id 62IDYmfEORDzkYlucXEqZtt7a1zBK6Ed access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA2-C2 content-length 5188 content-type image/webp x-amz-cf-id E84_YVFuYtvFgkcaDz2UFdPei8_ziu6fxX4gw7hJQfGUY6XQ5xJeAw==
GET H2	200	elec1.png.thumb.319.319.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/	25 KB 26 KB	64ms 40ms	Image image/webp	2600:9000:21f3:9a00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/elec1.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:9a00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash b29b1388d9b4de4ac0d5ba8b5c171174485de67babfb8114c2ee80d793372501 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id GQOzBl27KqEoXXJr4wkleG4_vORfqpg0 via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) etag "355365f99f3ef55de87738cf968464a5" age 8603 x-cache Hit from cloudfront x-amz-request-id DDMNN59VHY6K88NP x-amz-id-2 ItKJyfDVxYFpLZME8AMGO7KSgXu5qeT2lBIjmYRmkXvAouiWD0aMwGT5dt4U6be3F0rzdZxzugQ= accept-ranges bytes last-modified Fri, 29 Apr 2022 20:41:13 GMT server AmazonS3 date Wed, 18 May 2022 08:16:15 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA2-C2 content-length 25882 x-amz-cf-id GfGFZgtIn3Le9U-R1yV3ZT1CESKrCNzG-KsI_rizQJEqTdgglE7fHA==
GET H2	200	did-you-order-those-itunes-movies-nope-its-just-phishing-for-canadian-apple-users.jpg.thumb.319.319.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/	9 KB 10 KB	57ms 33ms	Image image/webp	2600:9000:21f3:9a00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/did-you-order-those-itunes-movies-nope-its-just-phishing-for-canadian-apple-users.jpg.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:9a00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash de95c5c99f44c4d380f8840a837e73dfbbe2f67fd64c2549e7b871d522af05f6 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id gAsu98vCqRKHYBNgQH52bb._6OKZqCuJ via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) etag "740a2070c4f966bb6042881a216f7f2a" age 13259 x-cache Hit from cloudfront x-amz-request-id CJZJGNFC2G731GJH x-amz-id-2 SxaeeRO6CiStFoi+edGQFj+dec59QECT3/YeS4A758/oio+hsTQZx1BzL7CW0J/sidSvV6AnY6Y= accept-ranges bytes last-modified Fri, 29 Apr 2022 21:31:50 GMT server AmazonS3 date Wed, 18 May 2022 06:58:39 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA2-C2 content-length 9656 x-amz-cf-id dyAAw9__hqFc38xz1fampEA2tTKGk9xMVmelAOeRPhSQhvoYi1zaBg==
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.10.0/	356 KB 78 KB	22ms 22ms	Script application/javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 18 May 2022 10:39:37 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 Bh9exWOPGIwRshWljrtlEw== age 12702 vary Accept-Encoding content-length 79698 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:43:00 GMT server cloudflare etag 0x8D89735260901BC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id b36fa4bd-801e-0008-41d1-2cc395000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70d3f8505f009085-FRA
GET H2	200	en.json Show response cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/2149c787-bccf-419d-b831-2a3ac6bafc66/	62 KB 14 KB	22ms 21ms	Fetch application/x-javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/2149c787-bccf-419d-b831-2a3ac6bafc66/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 047f3105c9c1c03b56fb255cbb8cbfbad3a41aeab4928d722f42be59e48175fb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 18 May 2022 10:39:37 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 PDee2klF9h+xwI77VTWe9Q== age 642 vary Accept-Encoding content-length 14507 x-ms-lease-status unlocked last-modified Fri, 12 Feb 2021 00:26:39 GMT server cloudflare etag 0x8D8CEECDD98A1AE expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id c7d0f214-501e-00a0-2dcf-111780000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70d3f850ae979273-FRA expires Wed, 18 May 2022 14:39:37 GMT
GET H2	200	otCenterRounded.json Show response cdn.cookielaw.org/scripttemplates/6.10.0/assets/	9 KB 3 KB	14ms 14ms	Fetch application/json	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otCenterRounded.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 18 May 2022 10:39:37 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 SH1nUCPouc1JVrHnvxpQbg== age 642 vary Accept-Encoding content-length 2857 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:42:51 GMT server cloudflare etag 0x8D89735210A49EB expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 62fd0741-301e-0099-4dcf-115724000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70d3f850ded59273-FRA
GET H2	200	otPcTab.json Show response cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/	45 KB 12 KB	14ms 14ms	Fetch application/json	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 18 May 2022 10:39:37 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 zNsRoM1FEmsEgJoYMCNTng== age 1116 vary Accept-Encoding content-length 11755 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:42:53 GMT server cloudflare etag 0x8D897352245C4EA expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id d4f81754-001e-00d5-19cf-11903b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70d3f850ded79273-FRA
GET DATA	200 OK	truncated /	42 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	fig1.1..png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image.img.png/1652300705505/	15 KB 15 KB	40ms 39ms	Image image/webp	2600:9000:21f3:9a00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image.img.png/1652300705505/fig1.1..png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:9a00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e483afa5e94a986f46186c517c0fa299da8a7e815d85296c735e05accab0cc47 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Wed, 18 May 2022 05:03:56 GMT via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) age 20142 x-cache Hit from cloudfront x-amz-request-id BNX7TQ5GZ3WK33K2 x-amz-id-2 OaExpbyIloVN8XALcpYEkhjHaFWg1jC1uM0+/XDcjSIDlyifkj1SA3ypeGm6yzkMoNvgD62rfEU= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:44 GMT server AmazonS3 etag "eca8b86858cd50d6846402c716152fd3" x-amz-version-id I05h4_oG1IlDz51UTAgmDGH6kz19sTpu access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA2-C2 content-length 15168 content-type image/webp x-amz-cf-id icEw5-VDIRa_zNKE17WuDsws56q5o6dyoeGXYcZ2fOTvCYmgNlROvw==
GET H2	200	fig2.1.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image_898255838.img.png/1652300758381/	27 KB 27 KB	34ms 33ms	Image image/webp	2600:9000:21f3:9a00:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image_898255838.img.png/1652300758381/fig2.1.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:9a00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 64bcc0986ce10299c4ffe23c2252e9c3274c33a6a906d337d0b183ea6a6d3c74 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id lfDNKnACBXQCGnWmcNT6wK6loJshmsEE via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) etag "d1ae6939653cfae3464073220dded0b2" age 48779 x-cache Hit from cloudfront x-amz-request-id S7KQCKQ42BK589X4 x-amz-id-2 ghQUS+OGJXSgJy7CYtLDdllc2TUoSMj92zQy4f/y0pw8MOgzLCTy3FyBnsioNYRmHQ9lfdtNpGw= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:39 GMT server AmazonS3 date Tue, 17 May 2022 21:06:39 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA2-C2 content-length 27410 x-amz-cf-id SU2ReTtswn5AsXUIj2qgOkCV7Slqk-rsU-_dIkW8yK6ErOLsFU39dw==
GET H2	200	launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response assets.adobedtm.com/	369 KB 80 KB	49ms 7ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash eaac14afa7c5ad33fe13e9e13b98a8edeb94f8de28d7286e666fa92cce6425e7 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Wed, 18 May 2022 10:39:37 GMT content-encoding gzip last-modified Tue, 17 May 2022 20:09:16 GMT server AkamaiNetStorage etag "6007333e1ac150f2d55465c54b60f16c:1652818156.281978" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 80941 expires Wed, 18 May 2022 11:39:37 GMT
GET H2	200	AppMeasurement.min.js Show response assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/	33 KB 12 KB	7ms 7ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/AppMeasurement.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 055e467aa53a9c0272d805bbc009ade8c74df5a8c1255271d753ac78fe179873 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Wed, 18 May 2022 10:39:38 GMT content-encoding gzip last-modified Wed, 19 Jan 2022 22:18:26 GMT server AkamaiNetStorage etag "85722a02b6a7feb74d08ac7875516bee:1642630706.903013" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 12243 expires Wed, 18 May 2022 11:39:38 GMT
GET H2	200	AppMeasurement_Module_ActivityMap.min.js Show response assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/	3 KB 2 KB	8ms 8ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/AppMeasurement_Module_ActivityMap.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash d4e77c7411d1de6efebf4278b9c98aa77dc2e5186cee271ac256138f17bef9f4 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Wed, 18 May 2022 10:39:38 GMT content-encoding gzip last-modified Wed, 19 Jan 2022 22:18:27 GMT server AkamaiNetStorage etag "9355415074dbdbd216a19b61ce931ab2:1642630707.219535" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 1599 expires Wed, 18 May 2022 11:39:38 GMT
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	31 KB 10 KB	38ms 8ms	Script application/javascript	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Wed, 18 May 2022 10:39:38 GMT Content-Encoding gzip X-Content-Type-Options nosniff Connection keep-alive Vary Accept-Encoding Content-Length 9715 Pragma no-cache Last-Modified Thu, 05 May 2022 03:45:17 GMT Server nginx/1.14.0 (Ubuntu) ETag "6273484d-7b02" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Cache-Control private, no-cache, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 18 May 2022 10:39:38 GMT
GET H2	200	RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/1b732585a03c/	358 B 494 B	7ms 7ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/1b732585a03c/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 5ca835b6b11b7153c122ed86bbe7b30d16539f95a1f44527e6bda8e18ce46491 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Wed, 18 May 2022 10:39:38 GMT content-encoding gzip last-modified Tue, 17 May 2022 20:09:17 GMT server AkamaiNetStorage etag "b59e0c2ddf1054da1ac03426537fb3e8:1652818157.117858" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 229 expires Wed, 18 May 2022 11:39:38 GMT
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 706 B	28ms 7ms	XHR application/json	37.252.172.45 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Pragma no-cache Date Wed, 18 May 2022 10:39:38 GMT X-Proxy-Origin 185.213.155.165; 185.213.155.165; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com AN-X-Request-Uuid a5ece4a3-0014-4722-9c1b-37fa4ef7056c Server nginx/1.21.3 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.fortinet.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 372 B	23ms 6ms	XHR text/plain	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software / Resource Hash bd551f0ac683e6d853f1cc8d473df912ab1a569786ede64c09856374db7a799a Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Wed, 18 May 2022 10:39:38 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://www.fortinet.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H2	200	/ Show response ipv6.6sc.co/	20 B 256 B	37ms 11ms	XHR text/html	2a02:26f0:6c00:294::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:294::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash b2e3fc362f86c882c8655f7d26cc8dde4c201cd22be17745cbff4357b2b8677d Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers pragma no-cache date Wed, 18 May 2022 10:39:38 GMT vary Origin content-type text/html access-control-allow-origin https://www.fortinet.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a03:1b20:6:f011::5e server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 20 expires Wed, 18 May 2022 10:39:38 GMT
GET H2	200	RC3bae6526bab9473dbbab7449e16ead11-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/1b732585a03c/	579 B 586 B	7ms 7ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/1b732585a03c/RC3bae6526bab9473dbbab7449e16ead11-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash b24f6cc761a0cc69bd985731b1116474f94f986710cfc3885b1f48209dd31bc7 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Wed, 18 May 2022 10:39:38 GMT content-encoding gzip last-modified Tue, 17 May 2022 20:09:17 GMT server AkamaiNetStorage etag "b59e0c2ddf1054da1ac03426537fb3e8:1652818157.117858" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 321 expires Wed, 18 May 2022 11:39:38 GMT
GET H2	200	RCe61896415d84436c959b7a66783b3417-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/1b732585a03c/	1 KB 816 B	8ms 8ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/1b732585a03c/RCe61896415d84436c959b7a66783b3417-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 6e2e555f4bb5a66c7720a62001bcd1e049b38436f801e6770e5ec8b5c594525e Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Wed, 18 May 2022 10:39:38 GMT content-encoding gzip last-modified Tue, 17 May 2022 20:09:17 GMT server AkamaiNetStorage etag "b59e0c2ddf1054da1ac03426537fb3e8:1652818157.117858" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 550 expires Wed, 18 May 2022 11:39:38 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	431 B 420 B	27ms 11ms	XHR application/json	52.57.195.65 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.195.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-195-65.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 43b21a37ead752a35feeeb473aecb119bc2b63800594adc825bcb903b81f23da Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 Authorization Token 82f0c18bd0395219670f57108eb160f3273629b2 EpsilonCookie cbd5ce178c6c0000eacc84625000000050de9600 Response headers date Wed, 18 May 2022 10:39:38 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://www.fortinet.com access-control-allow-credentials true content-length 234
OPTIONS H2	200	details epsilon.6sense.com/v3/company/	0 0	32ms 9ms	Preflight	52.57.195.65 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.195.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-195-65.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,epsiloncookie Access-Control-Request-Method GET Origin https://www.fortinet.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,epsiloncookie access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.fortinet.com access-control-max-age 1800 date Wed, 18 May 2022 10:39:38 GMT server nginx
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	200ms 184ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000eacc84625000000050de9600&session=94cd4e95-fe03-49b1-8b6c-12d980fcc525&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2018%20May%202022%2010%3A39%3A38%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=a2cd5544-1fa1-4629-8d05-ec48a32e4ed2&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Wed, 18 May 2022 10:39:38 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	205ms 191ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000eacc84625000000050de9600&session=94cd4e95-fe03-49b1-8b6c-12d980fcc525&event=ipv6&q=%7B%22address%22%3A%222a03%3A1b20%3A6%3Af011%3A%3A5e%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=a2cd5544-1fa1-4629-8d05-ec48a32e4ed2&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Wed, 18 May 2022 10:39:38 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	191ms 191ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000eacc84625000000050de9600&session=94cd4e95-fe03-49b1-8b6c-12d980fcc525&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20May%202022%2010%3A39%3A39%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20May%202022%2010%3A39%3A38%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=a2cd5544-1fa1-4629-8d05-ec48a32e4ed2&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Wed, 18 May 2022 10:39:39 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	191ms 190ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000eacc84625000000050de9600&session=94cd4e95-fe03-49b1-8b6c-12d980fcc525&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20May%202022%2010%3A39%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20May%202022%2010%3A39%3A39%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=a2cd5544-1fa1-4629-8d05-ec48a32e4ed2&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Wed, 18 May 2022 10:39:40 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	191ms 190ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000eacc84625000000050de9600&session=94cd4e95-fe03-49b1-8b6c-12d980fcc525&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20May%202022%2010%3A39%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20May%202022%2010%3A39%3A40%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%223008%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=a2cd5544-1fa1-4629-8d05-ec48a32e4ed2&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Wed, 18 May 2022 10:39:41 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	189ms 189ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c0000eacc84625000000050de9600&session=94cd4e95-fe03-49b1-8b6c-12d980fcc525&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20May%202022%2010%3A39%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20May%202022%2010%3A39%3A41%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%224011%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=a2cd5544-1fa1-4629-8d05-ec48a32e4ed2&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Wed, 18 May 2022 10:39:42 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT

68 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails object| OneTrustStub function| OptanonWrapper function| enableMarvel string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| Optanon object| OneTrust object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| setImmediate function| clearImmediate function| $ function| jQuery object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in number| timer_e object| _6si function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq boolean| _storagePopulated

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.fortinet.com/	1970-01-20 11:53:26	Name: cookiesession1 Value: 678A3E2606160D489C6B2C43D625CD40
			.fortinet.com/	1970-01-20 11:53:26	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Wed+May+18+2022+10%3A39%3A37+GMT%2B0000+(GMT)&version=6.10.0&hosts=&consentId=0fd0078c-426e-4685-92b3-1532869a2b5e&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
			.6sc.co/	1970-01-20 20:39:02	Name: 6suuid Value: cbd5ce178c6c0000eacc84625000000050de9600
			www.fortinet.com/	1970-01-20 20:39:02	Name: _gd_svisitor Value: cbd5ce178c6c0000eacc84625000000050de9600
			www.fortinet.com/	1970-01-20 03:17:55	Name: _an_uid Value: 0
			www.fortinet.com/	1970-01-20 20:39:02	Name: _gd_visitor Value: c789981f-dedc-4127-8cd4-bdc54b19565b
			www.fortinet.com/	1970-01-20 03:08:04	Name: _gd_session Value: 94cd4e95-fe03-49b1-8b6c-12d980fcc525

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block