www.fortinet.com Open in urlscan Pro
3.123.216.247  Public Scan

12 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

36 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request phishing-campaign-delivering-fileless-malware Show response www.fortinet.com/blog/threat-research/	51 KB 18 KB	1196ms 653ms	Document text/html	3.123.216.247 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-123-216-247.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 6ec468896d21319c817fbab067ae8ae05d596b8713a82807b8a26440172953af Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Cache-Control max-age=600, public Connection keep-alive Content-Encoding gzip Content-Length 17898 Content-Type text/html;charset=utf-8 Date Tue, 17 May 2022 12:21:33 GMT ETag "ca80-5df33e2a3697a-gzip" Last-Modified Tue, 17 May 2022 12:00:22 GMT Server Apache Strict-Transport-Security max-age=31536000; includeSubDomains Vary Accept-Encoding,User-Agent X-Content-Type-Options nosniff X-Dispatcher dispatcher2uswest1 X-Frame-Options SAMEORIGIN X-Vhost publish X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	clientlib-base.min.css www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/	217 KB 27 KB	222ms 203ms	Stylesheet text/css	3.123.216.247 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css?v=1 Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-123-216-247.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 9af0506f7d0221d9049280d06c6af4bc060a54a9657bbdef66bc3e85b8d00904 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Tue, 17 May 2022 12:21:33 GMT Content-Encoding gzip X-Content-Type-Options nosniff X-Vhost publish Connection keep-alive Vary Accept-Encoding,User-Agent Content-Length 27089 X-XSS-Protection 1; mode=block Last-Modified Fri, 29 Apr 2022 21:06:27 GMT Server Apache X-Frame-Options SAMEORIGIN ETag "3628c-5ddd16a6d3ac0-gzip" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type text/css;charset=utf-8 Cache-Control max-age=684000, public Accept-Ranges bytes
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	20 KB 7 KB	132ms 44ms	Script application/javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 03aa6fcac2902227e1b66a01b87824692f708bbf9bfe441784f8ed22d677f6de Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:21:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 +q2Bd0SvXowDeesSOf+0yw== age 10992 vary Accept-Encoding content-length 6782 x-ms-lease-status unlocked last-modified Fri, 13 May 2022 12:13:28 GMT server cloudflare etag 0x8DA34D9FD30D37D expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 461614fa-001e-005d-4ad7-6628e2000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc50431b985b44-FRA
GET H2	200	marvel.js Show response marvel-b2-cdn.bc0a.com/	9 KB 4 KB	134ms 40ms	Script application/javascript	35.201.125.192 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://marvel-b2-cdn.bc0a.com/marvel.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.201.125.192 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 192.125.201.35.bc.googleusercontent.com Software UploadServer / Resource Hash 965fc05b277596a937ba9d14388799fd5217eb96179f0187b8b937347bdfaf59 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:17:38 GMT content-encoding gzip age 235 x-guploader-uploadid ADPycdt2MHepFUQqmu2uqO9YlbBUo75j_fKpKVR03LHilleAXEwz5lBJ_AuOKEju7BQvu-LHVsgKrNyDfkc_2G8JhNrNPDRDn2ll x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 2 x-goog-stored-content-encoding gzip alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3217 last-modified Wed, 01 Sep 2021 18:16:49 GMT server UploadServer etag "5a385b6f8bc7f4775b2ec7b66c0ec4c2" vary Accept-Encoding x-goog-hash crc32c=0X9o7A==, md5=Wjhbb4vH9HdbLse2bA7Ewg== content-language en access-control-allow-origin * x-goog-generation 1630520209881243 access-control-expose-headers Content-Type cache-control public, max-age=3600 x-goog-stored-content-length 3217 accept-ranges bytes content-type application/javascript expires Tue, 17 May 2022 13:17:38 GMT
GET H/1.1	200 OK	fortinet-logo-white.svg www.fortinet.com/content/dam/fortinet-blog/	32 KB 3 KB	191ms 190ms	Image image/svg+xml	3.123.216.247 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-123-216-247.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Tue, 17 May 2022 12:21:33 GMT Content-Encoding gzip X-Content-Type-Options nosniff X-Vhost publish Content-Disposition attachment; filename="fortinet-logo-white.svg" Connection keep-alive Vary Accept-Encoding,User-Agent Content-Length 1998 X-XSS-Protection 1; mode=block Last-Modified Thu, 22 Feb 2018 23:16:01 GMT Server Apache X-Frame-Options SAMEORIGIN ETag "7ebb-565d53a1d6e40-gzip" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type image/svg+xml Cache-Control max-age=684000, public Accept-Ranges bytes
GET H/1.1	200 OK	clientlib-base.min.js Show response www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/	150 KB 69 KB	958ms 958ms	Script application/javascript	3.123.216.247 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 3.123.216.247 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-123-216-247.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 1e1a42cb75ebd81eb31850e485ef4c6e3667a45f57f778f249bca1f2852a97e4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Tue, 17 May 2022 12:21:33 GMT Content-Encoding gzip X-Content-Type-Options nosniff X-Vhost publish Connection keep-alive Vary Accept-Encoding,User-Agent Content-Length 70015 X-XSS-Protection 1; mode=block Last-Modified Thu, 14 Jan 2021 20:18:39 GMT Server Apache X-Frame-Options SAMEORIGIN ETag "25644-5b8e1f610c5c0-gzip" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type application/javascript;charset=utf-8 Cache-Control max-age=684000, public Accept-Ranges bytes
GET H2	200	f85f39fc-d7aa-467a-b762-fbb722748016.json Show response cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/	4 KB 2 KB	125ms 48ms	XHR application/x-javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a334f368b502d68bcaafb174022cfe21775f1744f0a1cd520d0c57d094a8e66a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:21:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 ypNp2Paf3c+p42YUXiXMnA== age 1239 vary Accept-Encoding content-length 1413 x-ms-lease-status unlocked last-modified Fri, 12 Feb 2021 00:26:33 GMT server cloudflare etag 0x8D8CEECD9FE5833 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 215ff62e-301e-00f4-77be-2cfd0a000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc5044bf719bf4-FRA expires Tue, 17 May 2022 16:21:33 GMT
GET DATA	200 OK	truncated /	71 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type image/png
GET H2	200	phishing-bitrat-pandora-part-one-hero.jpg marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/	38 KB 38 KB	242ms 137ms	Image image/webp	2600:9000:2057:7800:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/phishing-bitrat-pandora-part-one-hero.jpg Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:7800:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 57ca15ddb2fd45861fd4414dd2e205297188620cddb44b316c497c3f2c104d04 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id 1LGhphIgslTYhsMhATmml4SJRgcDpmcz via 1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront) etag "64aec2d0e7851def1e9c69f238f17ffd" age 20925 x-cache Hit from cloudfront x-amz-request-id CJZWSS6CGYDSKX90 x-amz-id-2 SQpeB/Ifc0wR8OKE7PUPGMDFfNm0C0FpylK7oesbSU1zyBfTwue4g8f/Zk+qRHvoNigsLU4aH1E= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:39 GMT server AmazonS3 date Tue, 17 May 2022 06:32:49 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 38714 x-amz-cf-id fc1xRRMkeu3rg-gRAqagb4OYgOFeeiKD4RkNXkOpDeMxtVyJ3k3D0Q==
GET H2	200	what-s-cooking-dridex-s-new-and-undiscovered-recipes.png.thumb.319.319.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/	5 KB 6 KB	147ms 63ms	Image image/webp	2600:9000:2057:7800:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/what-s-cooking-dridex-s-new-and-undiscovered-recipes.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:7800:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e9d0dce3bffb12ae344ee055850d36f892c0c00f5e3d3975bd71970288fcc35d Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id 62IDYmfEORDzkYlucXEqZtt7a1zBK6Ed via 1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront) etag "68bd98881d9b8a939de22d56665954d9" age 27106 x-cache Hit from cloudfront x-amz-request-id FT3CX4Z47YHVWHB3 x-amz-id-2 6a66tjhWBWY/gjTDzKbjWyUx50Y6ZvZXjdPd2ylU4dJzpowWko35eI0Dzg+Tx4NcYnUu4qHI56Y= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:38 GMT server AmazonS3 date Tue, 17 May 2022 04:49:48 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 5188 x-amz-cf-id wcuQ9-xjquRB1sHiroZh4VxKO91-kVHDSR2xXs-Bib5F61_SGHU8PA==
GET H2	200	elec1.png.thumb.319.319.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/	25 KB 26 KB	154ms 71ms	Image image/webp	2600:9000:2057:7800:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/elec1.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:7800:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash b29b1388d9b4de4ac0d5ba8b5c171174485de67babfb8114c2ee80d793372501 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id GQOzBl27KqEoXXJr4wkleG4_vORfqpg0 via 1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront) etag "355365f99f3ef55de87738cf968464a5" age 14778 x-cache Hit from cloudfront x-amz-request-id DDMNN59VHY6K88NP x-amz-id-2 ItKJyfDVxYFpLZME8AMGO7KSgXu5qeT2lBIjmYRmkXvAouiWD0aMwGT5dt4U6be3F0rzdZxzugQ= accept-ranges bytes last-modified Fri, 29 Apr 2022 20:41:13 GMT server AmazonS3 date Tue, 17 May 2022 08:15:16 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 25882 x-amz-cf-id cqhxvMZlIGihjAkOHGVV_6Un26Jh-zKVNf0tcZ_4bOyJTijRhYqybg==
GET H2	200	did-you-order-those-itunes-movies-nope-its-just-phishing-for-canadian-apple-users.jpg.thumb.319.319.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/	9 KB 10 KB	181ms 98ms	Image image/webp	2600:9000:2057:7800:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/did-you-order-those-itunes-movies-nope-its-just-phishing-for-canadian-apple-users.jpg.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:7800:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash de95c5c99f44c4d380f8840a837e73dfbbe2f67fd64c2549e7b871d522af05f6 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id gAsu98vCqRKHYBNgQH52bb._6OKZqCuJ via 1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront) etag "740a2070c4f966bb6042881a216f7f2a" age 20925 x-cache Hit from cloudfront x-amz-request-id CJZJGNFC2G731GJH x-amz-id-2 SxaeeRO6CiStFoi+edGQFj+dec59QECT3/YeS4A758/oio+hsTQZx1BzL7CW0J/sidSvV6AnY6Y= accept-ranges bytes last-modified Fri, 29 Apr 2022 21:31:50 GMT server AmazonS3 date Tue, 17 May 2022 06:32:49 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 9656 x-amz-cf-id AHacEqHoQQJeyKaJxaE8D6dDoibDSHhAOyA7F64M60F9A7wfvYaBTw==
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	153 B 432 B	151ms 66ms	XHR application/json	2606:4700:10::6814:b944 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6fba5ed9a21a948a1edf9f018055a8ed911df83da750fcb24177e2a3c539a085 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept application/json Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:21:33 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET, OPTIONS content-type application/json access-control-allow-origin * strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 70cc50458bac901f-FRA access-control-allow-headers Content-Type
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.10.0/	356 KB 78 KB	46ms 46ms	Script application/javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:21:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 Bh9exWOPGIwRshWljrtlEw== age 1593 vary Accept-Encoding content-length 79698 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:43:00 GMT server cloudflare etag 0x8D89735260901BC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id df9edcc3-f01e-00e2-6630-033c94000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc5045ff845b44-FRA
GET H2	200	en.json Show response cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/2149c787-bccf-419d-b831-2a3ac6bafc66/	62 KB 14 KB	44ms 44ms	Fetch application/x-javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/2149c787-bccf-419d-b831-2a3ac6bafc66/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 047f3105c9c1c03b56fb255cbb8cbfbad3a41aeab4928d722f42be59e48175fb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:21:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 PDee2klF9h+xwI77VTWe9Q== age 6135 vary Accept-Encoding content-length 14507 x-ms-lease-status unlocked last-modified Fri, 12 Feb 2021 00:26:39 GMT server cloudflare etag 0x8D8CEECDD98A1AE expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id bcc1cc11-601e-0081-60c1-117ab1000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc50469b5b9bf4-FRA expires Tue, 17 May 2022 16:21:33 GMT
GET H2	200	otCenterRounded.json Show response cdn.cookielaw.org/scripttemplates/6.10.0/assets/	9 KB 3 KB	45ms 45ms	Fetch application/json	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otCenterRounded.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:21:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 SH1nUCPouc1JVrHnvxpQbg== age 11296 vary Accept-Encoding content-length 2857 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:42:51 GMT server cloudflare etag 0x8D89735210A49EB expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 5c218a85-e01e-0075-2ac1-115f5d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc5046ec199bf4-FRA
GET H2	200	otPcTab.json Show response cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/	45 KB 12 KB	48ms 47ms	Fetch application/json	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 17 May 2022 12:21:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 zNsRoM1FEmsEgJoYMCNTng== age 901 vary Accept-Encoding content-length 11755 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:42:53 GMT server cloudflare etag 0x8D897352245C4EA expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 18ce0fd5-301e-005e-6dc1-112be5000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 70cc5046ec1b9bf4-FRA
GET DATA	200 OK	truncated /	42 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	fig1.1..png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image.img.png/1652300705505/	15 KB 15 KB	73ms 73ms	Image image/webp	2600:9000:2057:7800:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image.img.png/1652300705505/fig1.1..png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:7800:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e483afa5e94a986f46186c517c0fa299da8a7e815d85296c735e05accab0cc47 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id I05h4_oG1IlDz51UTAgmDGH6kz19sTpu via 1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront) etag "eca8b86858cd50d6846402c716152fd3" age 62553 x-cache Hit from cloudfront x-amz-request-id M2DC19QBQ5A5PQ8H x-amz-id-2 nuRqo2vHsUC5/1oEl+aktlYejFnD73f6VuivyynDKTLlWf1lv3ac0cXt5rOgOt8wdDn/Rn/eUHY= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:44 GMT server AmazonS3 date Mon, 16 May 2022 18:59:02 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 15168 x-amz-cf-id XWp1wcO0VwKbh2np--rOdIc7B5rVGNh9xALGE7AZB5dfQhxX_yOqvQ==
GET H2	200	fig2.1.png marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image_898255838.img.png/1652300758381/	27 KB 27 KB	92ms 91ms	Image image/webp	2600:9000:2057:7800:0:f267:a5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marvel-b1-cdn.bc0a.com/f00000000216283/www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware/_jcr_content/root/responsivegrid/image_898255838.img.png/1652300758381/fig2.1.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:7800:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 64bcc0986ce10299c4ffe23c2252e9c3274c33a6a906d337d0b183ea6a6d3c74 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers x-amz-version-id lfDNKnACBXQCGnWmcNT6wK6loJshmsEE via 1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront) etag "d1ae6939653cfae3464073220dded0b2" age 59729 x-cache Hit from cloudfront x-amz-request-id S7KQCKQ42BK589X4 x-amz-id-2 ghQUS+OGJXSgJy7CYtLDdllc2TUoSMj92zQy4f/y0pw8MOgzLCTy3FyBnsioNYRmHQ9lfdtNpGw= accept-ranges bytes last-modified Thu, 12 May 2022 15:03:39 GMT server AmazonS3 date Mon, 16 May 2022 19:46:06 GMT content-type image/webp access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 content-length 27410 x-amz-cf-id ijFPXfiFV-s04YsuXiiPGGhRAUN2-xLIudkdb8GMEBjrUOyedBK-nA==
GET H2	200	launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response assets.adobedtm.com/	369 KB 79 KB	163ms 37ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash be3cd2bf4ffcefbf9a4d2bf38f533d465d8152bf709b08c265b4844e551e36ef Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:21:34 GMT content-encoding gzip last-modified Mon, 09 May 2022 18:08:52 GMT server AkamaiNetStorage etag "4135345c405e42f8bb2ac55345c3f523:1652119732.361675" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 80750 expires Tue, 17 May 2022 13:21:34 GMT
GET H2	200	AppMeasurement.min.js Show response assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/	33 KB 12 KB	47ms 46ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/AppMeasurement.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 055e467aa53a9c0272d805bbc009ade8c74df5a8c1255271d753ac78fe179873 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:21:34 GMT content-encoding gzip last-modified Wed, 19 Jan 2022 22:18:26 GMT server AkamaiNetStorage etag "85722a02b6a7feb74d08ac7875516bee:1642630706.903013" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 12243 expires Tue, 17 May 2022 13:21:34 GMT
GET H2	200	AppMeasurement_Module_ActivityMap.min.js Show response assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/	3 KB 2 KB	47ms 47ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EPa06d4a70bf964e93808ee073533d9238/AppMeasurement_Module_ActivityMap.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash d4e77c7411d1de6efebf4278b9c98aa77dc2e5186cee271ac256138f17bef9f4 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:21:34 GMT content-encoding gzip last-modified Wed, 19 Jan 2022 22:18:27 GMT server AkamaiNetStorage etag "9355415074dbdbd216a19b61ce931ab2:1642630707.219535" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 1599 expires Tue, 17 May 2022 13:21:34 GMT
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	31 KB 10 KB	129ms 37ms	Script application/javascript	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:21:34 GMT Content-Encoding gzip X-Content-Type-Options nosniff Connection keep-alive Vary Accept-Encoding Content-Length 9715 Pragma no-cache Last-Modified Thu, 05 May 2022 03:45:17 GMT Server nginx/1.14.0 (Ubuntu) ETag "6273484d-7b02" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Cache-Control private, no-cache, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Tue, 17 May 2022 12:21:34 GMT
GET H2	200	RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/	358 B 494 B	37ms 37ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash d37e860faf31e1770a95e1d7ed540106a515cac001640c72562495db0e4038dc Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:21:34 GMT content-encoding gzip last-modified Mon, 09 May 2022 18:08:53 GMT server AkamaiNetStorage etag "2ef360583ccf0b27275ca758741f8b74:1652119733.259967" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 228 expires Tue, 17 May 2022 13:21:34 GMT
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 700 B	164ms 82ms	XHR application/json	37.252.172.38 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.172.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Pragma no-cache Date Tue, 17 May 2022 12:21:34 GMT X-Proxy-Origin 80.255.7.109; 80.255.7.109; 690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com AN-X-Request-Uuid ab506fed-8a80-4712-b976-861ddd17bb03 Server nginx/1.21.3 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.fortinet.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 372 B	188ms 36ms	XHR text/plain	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software / Resource Hash 656cdd0c86139b60ceb8ab080085643b5ea56da3dd166ba545e17f2ab2d57090 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:21:35 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://www.fortinet.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H2	200	/ Show response ipv6.6sc.co/	19 B 254 B	1091ms 48ms	XHR text/html	2a02:26f0:6c00:294::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:294::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash c829514739663b0fbaa1e5b4da63fecddb091258f1f8cb852c5e54e1b3fce9af Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers pragma no-cache date Tue, 17 May 2022 12:21:35 GMT vary Origin content-type text/html access-control-allow-origin https://www.fortinet.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::5 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 19 expires Tue, 17 May 2022 12:21:35 GMT
GET H2	200	RC3bae6526bab9473dbbab7449e16ead11-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/	579 B 586 B	37ms 37ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/RC3bae6526bab9473dbbab7449e16ead11-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 40cd024adb08f8eaf0a032eee9f3e9a9578cb7b7be0d34af04cc57a58dbfd46d Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:21:34 GMT content-encoding gzip last-modified Mon, 09 May 2022 18:08:53 GMT server AkamaiNetStorage etag "2ef360583ccf0b27275ca758741f8b74:1652119733.259967" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 320 expires Tue, 17 May 2022 13:21:34 GMT
GET H2	200	RCe61896415d84436c959b7a66783b3417-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/	1 KB 817 B	37ms 37ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2296ba9b9db/RCe61896415d84436c959b7a66783b3417-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 57cc8b4faf7c9e7e42330844dbaa3ac52aaa17eedc656644a47b18bfffb4a884 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:21:34 GMT content-encoding gzip last-modified Mon, 09 May 2022 18:08:53 GMT server AkamaiNetStorage etag "2ef360583ccf0b27275ca758741f8b74:1652119733.259967" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 550 expires Tue, 17 May 2022 13:21:34 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	432 B 421 B	119ms 41ms	XHR application/json	18.184.97.149 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.184.97.149 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-184-97-149.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash c56d2e2a7cb5a74f15d01417d51fc16c7b3745f0aaf96496f819d3d04e5391b9 Request headers Authorization Token 82f0c18bd0395219670f57108eb160f3273629b2 Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 12:21:35 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://www.fortinet.com access-control-allow-credentials true content-length 235
OPTIONS H2	200	details epsilon.6sense.com/v3/company/	0 0	127ms 39ms	Preflight	18.184.97.149 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.184.97.149 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-184-97-149.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization Access-Control-Request-Method GET Origin https://www.fortinet.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.fortinet.com access-control-max-age 1800 date Tue, 17 May 2022 12:21:35 GMT server nginx
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	306ms 220ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&session=b850a4a2-8919-436f-88ff-3dabbd7c23ba&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A21%3A34%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=966fdd23-dc8a-49ee-809f-64f6c8c88ae5&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:21:35 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	228ms 228ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c00004e9383622a030000b10c8600&session=b850a4a2-8919-436f-88ff-3dabbd7c23ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A21%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A21%3A34%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=966fdd23-dc8a-49ee-809f-64f6c8c88ae5&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:21:36 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	298ms 225ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c00004e9383622a030000b10c8600&session=b850a4a2-8919-436f-88ff-3dabbd7c23ba&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A5%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=966fdd23-dc8a-49ee-809f-64f6c8c88ae5&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:21:36 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	217ms 217ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c00004e9383622a030000b10c8600&session=b850a4a2-8919-436f-88ff-3dabbd7c23ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A21%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A21%3A35%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=966fdd23-dc8a-49ee-809f-64f6c8c88ae5&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:21:37 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	214ms 214ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c00004e9383622a030000b10c8600&session=b850a4a2-8919-436f-88ff-3dabbd7c23ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A21%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A21%3A36%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=966fdd23-dc8a-49ee-809f-64f6c8c88ae5&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:21:38 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	221ms 221ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=cbd5ce178c6c00004e9383622a030000b10c8600&session=b850a4a2-8919-436f-88ff-3dabbd7c23ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A21%3A38%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2017%20May%202022%2012%3A21%3A37%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224006%22%7D&isIframe=false&m=%7B%22description%22%3A%22FortiGuard%20Labs%20discovered%20a%20phishing%20campaign%20delivering%20fileless%20malware%20to%20steal%20sensitive%20information%20from%20a%20victim%E2%80%99s%20device.%20Read%20our%20analysis%20to%20find%20out%20more%20about%20how%20the%20campaign%20executes%20and%20maintains%20persistence%20on%20the%20victim%E2%80%99s%20device.%22%2C%22keywords%22%3A%22phishing%2CThreat%20Research%2Cmalware%2Cthreat%20analysis%22%2C%22title%22%3A%22Phishing%20Campaign%20Delivering%20Three%20Fileless%20Malware%3A%20AveMariaRAT%20%2F%20BitRAT%20%2F%20PandoraHVNC%20%E2%80%93%20Part%20I%20%7C%20FortiGuard%20Labs%26nbsp%3B%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&pageViewId=966fdd23-dc8a-49ee-809f-64f6c8c88ae5&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 17 May 2022 12:21:39 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT

68 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails object| OneTrustStub function| OptanonWrapper function| enableMarvel string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| Optanon object| OneTrust object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| setImmediate function| clearImmediate function| $ function| jQuery object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in number| timer_e object| _6si function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq boolean| _storagePopulated

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.fortinet.com/	1970-01-20 11:52:06	Name: cookiesession1 Value: 678A3E26B92F78E06B6B2BB8904BE0B5
			.fortinet.com/	1970-01-20 11:52:06	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Tue+May+17+2022+12%3A21%3A34+GMT%2B0000+(GMT)&version=6.10.0&hosts=&consentId=87f6ee73-e558-4c8a-b66d-6095609e9439&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fphishing-campaign-delivering-fileless-malware&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
			.6sc.co/	1970-01-20 20:37:42	Name: 6suuid Value: cbd5ce178c6c00004e9383622a030000b10c8600
			www.fortinet.com/	1970-01-20 03:16:34	Name: _an_uid Value: 0
			www.fortinet.com/	1970-01-20 20:37:42	Name: _gd_visitor Value: 57c49db6-0940-4a4b-8759-df6c94a5501d
			www.fortinet.com/	1970-01-20 03:06:44	Name: _gd_session Value: b850a4a2-8919-436f-88ff-3dabbd7c23ba
			www.fortinet.com/	1970-01-20 20:37:42	Name: _gd_svisitor Value: cbd5ce178c6c00004e9383622a030000b10c8600

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block