www.fortinet.com Open in urlscan Pro
13.56.33.144 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2.html
Effective URL:
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
Submission: On October 22 via api (October 22nd 2020, 7:30:46 pm UTC) from US

Summary HTTP 93 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 35 IPs in 6 countries across 32 domains to perform 93 HTTP transactions. The main IP is 13.56.33.144, located in San Jose, United States and belongs to AMAZON-02, US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on January 22nd 2019. Valid for: 2 years.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 21	13.56.33.144 13.56.33.144	16509 (AMAZON-02) (AMAZON-02)
9	2a02:26f0:10c... 2a02:26f0:10c:5b1::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 5	52.48.66.74 52.48.66.74	16509 (AMAZON-02) (AMAZON-02)
5	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.111.216.96 104.111.216.96	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.248.119.134 34.248.119.134	16509 (AMAZON-02) (AMAZON-02)
2	15.237.136.106 15.237.136.106	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	52.85.32.94 52.85.32.94	16509 (AMAZON-02) (AMAZON-02)
1	23.111.11.182 23.111.11.182	33438 (HIGHWINDS2) (HIGHWINDS2)
1	54.192.206.8 54.192.206.8	16509 (AMAZON-02) (AMAZON-02)
2	13.225.73.109 13.225.73.109	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE)
1	52.85.32.11 52.85.32.11	16509 (AMAZON-02) (AMAZON-02)
3	23.111.11.71 23.111.11.71	33438 (HIGHWINDS2) (HIGHWINDS2)
2	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
1	34.255.46.51 34.255.46.51	16509 (AMAZON-02) (AMAZON-02)
1	96.45.36.159 96.45.36.159	40934 (FORTINET) (FORTINET)
3	18.232.28.189 18.232.28.189	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
2	2a02:26f0:10c... 2a02:26f0:10c:58e::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 7	34.249.122.179 34.249.122.179	16509 (AMAZON-02) (AMAZON-02)
1 5	104.111.214.206 104.111.214.206	16625 (AKAMAI-AS) (AKAMAI-AS)
1	172.217.21.226 172.217.21.226	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1 1	54.72.203.20 54.72.203.20	16509 (AMAZON-02) (AMAZON-02)
1	54.171.111.254 54.171.111.254	16509 (AMAZON-02) (AMAZON-02)
2 2	34.120.207.148 34.120.207.148	15169 (GOOGLE) (GOOGLE)
2 2	52.49.73.64 52.49.73.64	16509 (AMAZON-02) (AMAZON-02)
2 2	52.48.137.92 52.48.137.92	16509 (AMAZON-02) (AMAZON-02)
1 2	3.125.70.222 3.125.70.222	16509 (AMAZON-02) (AMAZON-02)
1	52.87.143.234 52.87.143.234	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
93	35

21 13.56.33.144 (San Jose, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-56-33-144.us-west-1.compute.amazonaws.com

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:26f0:10c:5b1::1e80 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.48.66.74 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-48-66-74.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.216.96 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-216-96.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.248.119.134 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-119-134.eu-west-1.compute.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.237.136.106 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.32.94 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-32-94.ham50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.182 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.206.8 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-206-8.ham50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.73.109 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-73-109.fra2.r.cloudfront.net

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.32.11 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-32-11.ham50.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.111.11.71 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.255.46.51 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-46-51.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.45.36.159 (San Jose, United States)

ASN40934 (FORTINET, US)

site.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.232.28.189 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-6-ue1.aws.pardot.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
go.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:58e::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.249.122.179 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-122-179.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.111.214.206 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-214-206.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.21.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s13-in-f226.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.72.203.20 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-72-203-20.eu-west-1.compute.amazonaws.com

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.171.111.254 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-111-254.eu-west-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.207.148 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 148.207.120.34.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.49.73.64 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-73-64.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.48.137.92 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.125.70.222 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-125-70-222.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.87.143.234 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

nextroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	fortinet.com 1 redirects www.fortinet.com metrics.fortinet.com site.fortinet.com go.fortinet.com	1 MB
9	adobedtm.com assets.adobedtm.com	78 KB
7	ml314.com 1 redirects ml314.com	15 KB
6	adroll.com 1 redirects s.adroll.com d.adroll.com	70 KB
6	demdex.net 2 redirects dpm.demdex.net fortinet.demdex.net	4 KB
5	googletagmanager.com www.googletagmanager.com	186 KB
5	omappapi.com api.omappapi.com a.omappapi.com	44 KB
4	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com in.hotjar.com	74 KB
4	addthis.com s7.addthis.com m.addthis.com	191 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
2	google.de www.google.de	667 B
2	google.com www.google.com	433 B
2	doubleclick.net googleads.g.doubleclick.net	3 KB
2	eyeota.net 1 redirects ps.eyeota.net	1 KB
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1003 B
2	adsrvr.org 2 redirects match.adsrvr.org	928 B
2	rlcdn.com 2 redirects idsync.rlcdn.com	803 B
2	facebook.com www.facebook.com	463 B
2	licdn.com snap.licdn.com	3 KB
2	facebook.net connect.facebook.net	92 KB
2	pardot.com pi.pardot.com	4 KB
2	google-analytics.com www.google-analytics.com	18 KB
1	nextroll.com nextroll.com	2 KB
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	137 B
1	t.co t.co	448 B
1	twitter.com analytics.twitter.com	650 B
1	googleadservices.com www.googleadservices.com	12 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	addthisedge.com v1.addthisedge.com	756 B
1	opmnstr.com a.opmnstr.com	62 KB
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	moatads.com z.moatads.com	1 KB
93	32

	Domain	Requested by
21	www.fortinet.com	1 redirects www.fortinet.com
9	assets.adobedtm.com	www.fortinet.com assets.adobedtm.com
7	ml314.com	1 redirects www.fortinet.com ml314.com
5	s.adroll.com	1 redirects www.fortinet.com s.adroll.com
5	www.googletagmanager.com	www.fortinet.com www.googletagmanager.com assets.adobedtm.com
5	dpm.demdex.net	2 redirects www.fortinet.com
3	a.omappapi.com	a.opmnstr.com
3	s7.addthis.com	assets.adobedtm.com s7.addthis.com
2	www.google.de
2	www.google.com
2	googleads.g.doubleclick.net	www.googleadservices.com
2	ps.eyeota.net	1 redirects
2	sync.crwdcntrl.net	2 redirects
2	match.adsrvr.org	2 redirects
2	idsync.rlcdn.com	2 redirects
2	px.ads.linkedin.com	1 redirects
2	www.facebook.com	connect.facebook.net
2	snap.licdn.com	www.fortinet.com snap.licdn.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	pi.pardot.com	www.fortinet.com pi.pardot.com
2	www.google-analytics.com	a.opmnstr.com www.google-analytics.com
2	api.omappapi.com	a.opmnstr.com
2	metrics.fortinet.com	assets.adobedtm.com www.fortinet.com
1	go.fortinet.com	pi.pardot.com
1	nextroll.com
1	d.adroll.com
1	d.adroll.mgr.consensu.org	1 redirects
1	t.co
1	analytics.twitter.com	static.ads-twitter.com
1	www.linkedin.com	1 redirects
1	www.googleadservices.com	www.googletagmanager.com
1	static.ads-twitter.com	www.fortinet.com
1	site.fortinet.com	www.fortinet.com
1	in.hotjar.com	script.hotjar.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	a.opmnstr.com	assets.adobedtm.com
1	static.hotjar.com	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	assets.adobedtm.com
1	z.moatads.com	s7.addthis.com
93	43

This site contains links to these domains. Also see Links.

Domain
blog.fortinet.com
support.office.com
support.microsoft.com
msdn.microsoft.com
www.facebook.com
www.twitter.com
www.youtube.com
www.linkedin.com
www.instagram.com
fortiguard.com
secure.fortinet.com
fusecommunity.fortinet.com
cookie-script.com
www.addthis.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-22` - `2021-03-31`	2 years	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-07-22` - `2021-10-13`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
metrics.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-29` - `2021-02-02`	2 years	crt.sh
*.hotjar.com Amazon	`2020-01-22` - `2021-02-22`	a year	crt.sh
*.opmnstr.com Go Daddy Secure Certificate Authority - G2	`2019-04-11` - `2021-04-11`	2 years	crt.sh
api.opmnstr.com Amazon	`2020-04-09` - `2021-05-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.omappapi.com Go Daddy Secure Certificate Authority - G2	`2020-03-16` - `2022-03-16`	2 years	crt.sh
pi.pardot.com DigiCert SHA2 Secure Server CA	`2019-12-26` - `2020-12-26`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.ml314.com Amazon	`2020-02-17` - `2021-03-17`	a year	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
adroll.mgr.consensu.org Amazon	`2020-10-08` - `2021-11-07`	a year	crt.sh
*.eyeota.net Let's Encrypt Authority X3	`2020-08-31` - `2020-11-29`	3 months	crt.sh
nextroll.com Let's Encrypt Authority X3	`2020-09-20` - `2020-12-19`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
go.fortinet.com Let's Encrypt Authority X3	`2020-09-25` - `2020-12-24`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
Frame ID: C68F64BA10993B59A9C81B25C0EEE899
Requests: 91 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 22E9E837818C53AAD93A63F5567DFD19
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 78CA8672941963E5E19A2D255CFE2939
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 22AD01CCDD0C5D9702E7C4FE41AE8ED7
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: 9A32022A752431D78593BF22569FCDA2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2.html HTTP 301
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2 Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Adobe DTM (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/assets.adobedtm.com\//i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

93
Requests

99 %
HTTPS

28 %
IPv6

32
Domains

43
Subdomains

35
IPs

6
Countries

2012 kB
Transfer

4434 kB
Size

18
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1
Title: the first part

Search URL Search Domain Scan URL

URL: https://support.office.com/en-us/article/Introduction-to-Outlook-Data-Files-pst-and-ost-6d4197ec-1304-4b81-a17d-66d4eef30b78
Title: https://support.office.com/en-us/article/Introduction-to-Outlook-Data-Files-pst-and-ost-6d4197ec-1304-4b81-a17d-66d4eef30b78

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/help/287070/how-to-manage-.pst-files-in-microsoft-outlook
Title: https://support.microsoft.com/en-us/help/287070/how-to-manage-.pst-files-in-microsoft-outlook

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us/library/office/cc765775(v=office.14).aspx
Title: https://msdn.microsoft.com/en-us/library/office/cc765775(v=office.14).aspx

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/SecureNetworks
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/behindthefirewall/
Title:

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://secure.fortinet.com/fortiguard
Title: Threat Briefs

Search URL Search Domain Scan URL

URL: https://fusecommunity.fortinet.com/
Title: Fuse Community

Search URL Search Domain Scan URL

URL: https://cookie-script.com/
Title: Free cookie consent by cookie-script.com

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2.html HTTP 301
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 17

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603395003939 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603395003939

Request Chain 28

https://cm.everesttech.net/cm/dd?d_uuid=28689732721910292353705127744846262816 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5HdvAAAB-8hFBTJ

Request Chain 70

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603395008417&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26time%3D1603395008417%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fdeep-analysis-of-new-emotet-variant-part-2%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603395008417&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&liSync=true

Request Chain 73

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 75

https://d.adroll.mgr.consensu.org/consent/iabcheck/7OBVBCAQE5FHDPFEAD5T4D?_s=b6a8e899102542711464329e1642a62c&_b=2 HTTP 302
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=b6a8e899102542711464329e1642a62c&_b=2

Request Chain 77

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3614007910639075400&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3614007910639075400&redir=

Request Chain 78

https://idsync.rlcdn.com/395886.gif?partner_uid=3614007910639075400 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYxNDAwNzkxMDYzOTA3NTQwMBAAGg0IwbvH_AUSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=ce432b558997748e575ccce191d1a14658053083f5dd27b6e6da16f6d305c613f4cb09cee1a4f8eb&person_id=3614007910639075400&eid=50082

Request Chain 79

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=3d20cb64-bd0c-4d82-82a9-38581b2c4015 HTTP 302
https://ml314.com/csync.ashx?fp=3d20cb64-bd0c-4d82-82a9-38581b2c4015&person_id=3614007910639075400&eid=53819

Request Chain 80

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614007910639075400 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614007910639075400 HTTP 302
https://ml314.com/csync.ashx?fp=a59825ebb8fcf81ee1a0bcf8a039ea6a&eid=50146&person_id=3614007910639075400

Request Chain 81

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif

93 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request deep-analysis-of-new-emotet-variant-part-2 Show response
www.fortinet.com/blog/threat-research/
Redirect Chain

https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2.html
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

34 KB
12 KB

181ms
180ms

Document
text/html

13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

20beb39b6d84166b10ddd97034b3eda4914934a89ab8ade555a9f20f9409b79a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.fortinet.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: cookiesession1=2C6411B9QFDIZFNF7CS823UZJG46D380
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=600, public
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Thu, 22 Oct 2020 19:30:03 GMT
ETag: "87a6-5b2475f4a92d6-gzip"
Last-Modified: Thu, 22 Oct 2020 19:21:34 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
Content-Length: 11346
Connection: keep-alive

Redirect headers

Content-Type: text/html; charset=iso-8859-1
Date: Thu, 22 Oct 2020 19:30:03 GMT
Location: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Dispatcher: dispatcher1uswest1
X-Vhost: publish
Content-Length: 296
Connection: keep-alive
Set-Cookie: cookiesession1=2C6411B9QFDIZFNF7CS823UZJG46D380;Path=/;HttpOnly

GET
H/1.1 200
OK clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 217 KB
27 KB 186ms
186ms Stylesheet
text/css 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

7ef0ff6db29fbb95501a2bbcbcb741474fa3cb3511009901a2fe7369084ae234

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 22 Oct 2020 19:30:03 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Length: 27147
Last-Modified: Wed, 09 Sep 2020 21:03:28 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "36377-5aee7c87f0800-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/css;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 247 KB
60 KB 31ms
9ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: fc5b6932c605af2013fb5ad7fb59d30d267a8a7623c352d1fddffe88bfce84ea

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:03 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:52 GMT
server: AkamaiNetStorage
status: 200
etag: "826090bcbe30f1049578ab162b96f733:1603326472.644124"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 60549
expires: Thu, 22 Oct 2020 20:30:03 GMT

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 721ms
184ms Image
image/svg+xml 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 22 Oct 2020 19:30:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Length: 1998
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "7ebb-565d53a1d6e40-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/svg+xml
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2431.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 56 KB
56 KB 764ms
226ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2431.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

43b2db2fa1fdf8a98142afb6f8566ae849be0002dd755683bf707a10a4e99f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 22 Oct 2020 19:30:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:41:01 GMT
Server: Apache
ETag: "dfb5-56f2dc57bf540"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 57269

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2432.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 61 KB
62 KB 870ms
330ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2432.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

fa1aff33ee6e46f4105be4d25f9241e69116def9d2b1413d692acde88e27d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 22 Oct 2020 19:30:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:33:37 GMT
Server: Apache
ETag: "f574-56f2dab050e40"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 62836

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2433.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 63 KB
63 KB 832ms
292ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2433.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

a35755220eca4f3d10ee29cf3f145e59f963cf3c4c45ed2f19994b987ef185d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 22 Oct 2020 19:30:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:31:25 GMT
Server: Apache
ETag: "fa50-56f2da326e540"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 64080

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2434.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 73 KB
73 KB 547ms
188ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2434.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

1e4e963df26efc81406a308ba13b1020e933c9d38ef1c7d52c1575b6a35ff920

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 22 Oct 2020 19:30:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:24:53 GMT
Server: Apache
ETag: "122ac-56f2d8bc97340"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 74412

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2435.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 108 KB
109 KB 182ms
181ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2435.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

8742b3448ac5ce571142fbed237512dd79ccf759472eb5186da17c5c6009cba7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 22 Oct 2020 19:30:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:22:35 GMT
Server: Apache
ETag: "1b117-56f2d838fbcc0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 110871

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2436.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 89 KB
90 KB 202ms
201ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2436.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

71aa1b3adc87bcef41d1d4f251e6f9a0f586c4b9025d3c8f873dfa5aa3774d1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 22 Oct 2020 19:30:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:39:08 GMT
Server: Apache
ETag: "16513-56f2dbebfb700"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 91411

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2437.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 56 KB
57 KB 223ms
222ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2437.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d15548f7fd31c9e601349c206aa012baff6e50ca2218a63d62a29429d31ecf59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 22 Oct 2020 19:30:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:38:14 GMT
Server: Apache
ETag: "e165-56f2dbb87bd80"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 57701

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2438.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 100 KB
100 KB 201ms
201ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2438.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

6748364feee8081655210f98e7d769bc02d297e1bf32e8022eb172fb1dacc3a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 22 Oct 2020 19:30:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:22:24 GMT
Server: Apache
ETag: "18e50-56f2d82e7e400"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 101968

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2439.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 39 KB
39 KB 182ms
181ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2439.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

ed6e7dbac93a75b3f75a6bf57a607ff555dc436254c28ede3aa2bd12d16b9dcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 22 Oct 2020 19:30:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:29:53 GMT
Server: Apache
ETag: "9b91-56f2d9dab1640"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 39825

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2440.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 60 KB
60 KB 199ms
198ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2440.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

c35f165a558d326d2f43762f0586fffe0be8b03f01e7093efeefadc06fb17e72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 22 Oct 2020 19:30:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:33:01 GMT
Server: Apache
ETag: "f026-56f2da8dfbd40"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 61478

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2441.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 11 KB
11 KB 183ms
183ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2441.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

35a158350cb0c9e4589f0051518c7205622d66b0cf77c8ca2044c7ff23a6e8d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 22 Oct 2020 19:30:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:28:10 GMT
Server: Apache
ETag: "2c0b-56f2d97876e80"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 11275

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2-2442.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 38 KB
39 KB 186ms
185ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-2-2442.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

839c8187f44daed8f92e33e0f77136b26436f8f92a863536b65cf2a94f7e4881

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 22 Oct 2020 19:30:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:35:04 GMT
Server: Apache
ETag: "9921-56f2db0349200"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 39201

GET
H/1.1 200
OK clientlib-base.min.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 167 KB
76 KB 539ms
194ms Script
application/javascript 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

1240dad403c8c0dae31b46cf4219409e27275153dda4086c2dddc9d1ed42d131

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 22 Oct 2020 19:30:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
content-length: 77154
Last-Modified: Mon, 10 Aug 2020 17:39:38 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "29a67-5ac89704aca80-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603395003939
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603395003939

367 B
1 KB

49ms
49ms

XHR
application/json

52.48.66.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603395003939

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.48.66.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-48-66-74.eu-west-1.compute.amazonaws.com

Software

Resource Hash

53bc3e09acc2c8d8f769c7c789b58a5e23d1e1f123e10379d1690c408182701f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v084-0d31d6e19.edge-irl1.demdex.com 5.78.2.20201014153347 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: IXIgsZ86SQw=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.fortinet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 300
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://www.fortinet.com
X-TID: jBEBl7UeQ0k=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603395003939
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 33 KB
12 KB 10ms
9ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:03 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
status: 200
etag: "f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12184
expires: Thu, 22 Oct 2020 20:30:03 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 3 KB
2 KB 15ms
15ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:03 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
status: 200
etag: "5dedcda2c8a6c3a51fd419d306427010:1597270192.857753"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1594
expires: Thu, 22 Oct 2020 20:30:03 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 103ms
39ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Thu, 22 Oct 2020 19:30:04 GMT
x-host: s7.addthis.com
content-length: 116324
x-akamai-path-stats: [3:141006:4294965290],[3:138018:4294830278],[3:145538:4294827758],[3:138797:4294822499],[3:138203:4294829093],[3:138904:4294827392],[3:138596:4294829700],[3:142152:4294828144],[3:143957:4294820339],[3:137655:4294830641],[3:138125:4294828171],[3:144046:4294828250],[3:138257:4294824039],[3:144061:4294830235],[3:138241:4294826055],[3:146418:4294823878]

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 55 KB
56 KB 308ms
204ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/deep-analysis-of-new-emotet-variant-part-2.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

b6c29512b7d321aa70701ef365f1f6c7ea25dff345206a54e5304216135f3e38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 22 Oct 2020 19:30:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Mar 2018 18:32:06 GMT
Server: Apache
ETag: "dde6-5673b5be4b580"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 56806

GET
H/1.1 200
OK information-stealing-malware-is-spread-via-word-document.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 150 KB
151 KB 205ms
205ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/information-stealing-malware-is-spread-via-word-document.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

35833466352a77a63951e175a39d77dff813bc8ad865270c67ff7338ab9a36e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 22 Oct 2020 19:30:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Mar 2018 22:26:32 GMT
Server: Apache
ETag: "25976-5673ea24ad600"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 153974

GET
H/1.1 200
OK microsoft-word-file-spreads-malware-targeting-both-mac-os-x-and-windows-part-ii.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 28 KB
28 KB 196ms
196ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/microsoft-word-file-spreads-malware-targeting-both-mac-os-x-and-windows-part-ii.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

0ee86ed5cc3cc663964bf3d622e778902cccaaaa23ea8a6bc2c3ae268ec49d6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 22 Oct 2020 19:30:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Mar 2018 18:33:21 GMT
Server: Apache
ETag: "6f70-5673b605d1e40"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 28528

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 35 KB
35 KB 186ms
185ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/deep-analysis-of-new-emotet-variant-part-2.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

9ce9e23b2f0aff01f3a20cde4e99e014e306dfb3c420bee920ea9e0f323a6ccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 22 Oct 2020 19:30:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Mar 2018 18:32:08 GMT
Server: Apache
ETag: "8a6d-5673b5c033a00"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 35437

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 100ms
33ms Script
application/x-javascript 104.111.216.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-216-96.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:04 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: 6CDA04CEF72D568E
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=50123
accept-ranges: bytes
content-length: 948
x-amz-id-2: vmrAbpbzrBs8g4V4M3AoGAqwWb0EhELJ1wy9AWvX/tuPVstbiwgv0ja/UaK2kknp20dNDPCNIa4=

GET
H/1.1 200
OK Cookie set dest5.html
fortinet.demdex.net/ Frame 22E9 0
0 216ms
51ms Document
text/html 34.248.119.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.248.119.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-248-119-134.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: fortinet.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=28689732721910292353705127744846262816
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 15 Oct 2020 15:24:41 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=28689732721910292353705127744846262816;Path=/;Domain=.demdex.net;Expires=Tue, 20-Apr-2021 19:30:04 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: VNvzufQrRGc=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
metrics.fortinet.com/ 48 B
511 B 160ms
42ms XHR
application/x-javascript 15.237.136.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.fortinet.com/id?d_visid_ver=5.0.1&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=28345958365509341393741752509520368552&ts=1603395004196

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

b9c55c23ca137f163542ae6e8e3c0e2bf193d9e9d0cf3678bd2e7b4eb3763072

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Thu, 22 Oct 2020 19:30:03 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-7dd9449d74-7fflp
vary: Origin
x-c: master-1397.I728fb3.M0-462
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=X5HdvAAAB-8hFBTJ
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=28689732721910292353705127744846262816
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5HdvAAAB-8hFBTJ

42 B
915 B

48ms
48ms

Image
image/gif

52.48.66.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5HdvAAAB-8hFBTJ

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.48.66.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-48-66-74.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v084-0d74368f2.edge-irl1.demdex.com 5.78.2.20201014153347 1ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: L10qjtj8ThA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Thu, 22 Oct 2020 19:30:03 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5HdvAAAB-8hFBTJ
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 s26270103127412
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.0-LAWA/ 43 B
328 B 42ms
41ms Image
image/gif 15.237.136.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.0-LAWA/s26270103127412?AQB=1&ndh=1&pf=1&t=22%2F9%2F2020%2021%3A30%3A4%204%20-120&mid=28345958365509341393741752509520368552&aamlh=6&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Adeep-analysis-of-new-emotet-variant-part-2&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&cc=USD&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Adeep-analysis-of-new-emotet-variant-part-2&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:03 GMT
x-content-type-options: nosniff
x-c: master-1397.I728fb3.M0-462
p3p: CP="This is not a P3P policy"
status: 200
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 23 Oct 2020 19:30:04 GMT
server: jag
xserver: anedge-7dd9449d74-69cqx
etag: 3443264552460189696-4621619992214411970
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 21 Oct 2020 19:30:04 GMT

GET
H2 200 hotjar-1178304.js Show response
static.hotjar.com/c/ 4 KB
2 KB 266ms
66ms Script
application/javascript 52.85.32.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1178304.js?sv=6

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.32.94 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-32-94.ham50.r.cloudfront.net

Software

Resource Hash

1c2896ac1d293a393f68006bf2c99bba800970abc1b127a4f6c57964c427ab58

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:04 GMT
content-encoding: br
x-content-type-options: nosniff
x-cache-hit: 1
x-amz-cf-pop: HAM50-C1
status: 200
etag: W/9e5a739b53f24a04d1abda0ba9ecc16d
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=60
content-length: 1679
via: 1.1 04545073f97f94a6b7b4580892eff70d.cloudfront.net (CloudFront)
x-amz-cf-id: P9a1daHMDVtkwaZ85QK_6xvn0masSDOxChm28QrfFBkt6TWoSQKpgQ==

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 210 KB
62 KB 244ms
45ms Script
application/javascript 23.111.11.182
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.182 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 918abef382f3aa12111b9be55aa6f5f6557439e95563a274f01b0bbe063435bd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:04 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 14:06:21 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 450AA6FF23C1EB47
etag: W/"5a3dfda136bff71632cabf8015d52061"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: tOdNX8ewqP+zQeQhIXTOK+bP8csa3Vk0gIRwaPc+tjDJyrfzY8wbUpWfgoX2g6eZA4D59/MfgL0=
expires: Sun, 17 Oct 2021 19:30:04 GMT

GET
H2 200 RCc1e0e9525773456f8571be34d2bb1032-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 1 KB
803 B 68ms
67ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RCc1e0e9525773456f8571be34d2bb1032-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 97e95fcc66a29acfd27e371656c24da14947aace63dfa4db95fa8482f8bfb4bc

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:04 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 536
expires: Thu, 22 Oct 2020 20:30:04 GMT

GET
H2 200 RCb652faf409a54c3db318899e2cbcc95c-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 881 B
719 B 91ms
91ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RCb652faf409a54c3db318899e2cbcc95c-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f692ee03941001acfb64ab453b8ad134f6d8b8927d29ef586ef052d848878cfd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:04 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 452
expires: Thu, 22 Oct 2020 20:30:04 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/ 2 KB
756 B 316ms
315ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:05 GMT
content-encoding: gzip
etag: 1861047380--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=56, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 580

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 88 B
248 B 235ms
232ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5f91ddbc159f0158&bkl=0&bl=1&pdt=1143&sid=5f91ddbc159f0158&pub=ra-5d48adfc650f1a9e&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.fortinet.com&fp=blog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=osx%2Cvba%2Cbotnet%2Cfortiguard%2Cthreat%20research%2Cwindows%2Cmicrosoft%20word%2CThreat%20Research%2Cmacros%2Cemotet&colc=1603395004741&jsl=1&uvs=5f91ddbce28206ad000&skipb=1&callback=addthis.cbs.jsonp__3916258944572830
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7b629f4dac3d245066275be536f9d424fef26b751adba1c9f536e43bdd92d856

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Thu, 22 Oct 2020 19:30:04 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 88
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 78CA 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 22AD 0
0 42ms
42ms Document
text/html 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
etag: W/"5ed917ff-11adc"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 26421
date: Thu, 22 Oct 2020 19:30:07 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H2 200 modules.8892a865463d29e21514.js Show response
script.hotjar.com/ 361 KB
71 KB 140ms
53ms Script
application/javascript 54.192.206.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.8892a865463d29e21514.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1178304.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.206.8 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-206-8.ham50.r.cloudfront.net

Software

Resource Hash

96b7353cfc0c512962840bc951b0e1009d3419defac1a37a7b1149e8ea3d43cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 20 Oct 2020 11:51:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 200296
x-cache: Hit from cloudfront
status: 200
content-length: 72450
access-control-allow-origin: *
last-modified: Tue, 20 Oct 2020 11:48:03 GMT
etag: "bdab316b804b450b477b25a55b099ba6"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 20997ca80e84f6ddda445ba948f015bd.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: -SXLPm-d21m5sHVcuzDZ0Ydly6xpCDAwufQyLLqZBgZJMVP5jHDfBQ==

GET
H2 200 layers.33f5b85045a5f2308467.js Show response
s7.addthis.com/static/ 263 KB
76 KB 34ms
33ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.33f5b85045a5f2308467.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Thu, 22 Oct 2020 19:30:07 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77540

GET
H2 200 39852 Show response
api.omappapi.com/v2/embed/ 24 KB
5 KB 255ms
162ms XHR
application/json 13.225.73.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.73.109 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-73-109.fra2.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: ad3e85ce77ea499a5d5c5815b536337c4305e3801a09572efd49010287cf9df0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:07 GMT
content-encoding: gzip
x-cache-config: 0 0
x-amz-cf-pop: FRA2-C2
x-cache-status: HIT
x-cache: Miss from cloudfront
status: 200
access-control-allow-headers: X-CSRF-Token
x-optinmonster-account: 45602
x-user-agent: standard--
last-modified: Fri, 16 Oct 2020 03:41:03 GMT
server: Pagely Gateway/1.5.1
etag: W/"fb01511765f50524150c49c4b55b1e64"
vary: Accept-Encoding, User-Agent
content-type: application/json
via: 1.1 ac0e9b19969df989a920e6d1b834d009.cloudfront.net (CloudFront)
access-control-expose-headers: X-OptinMonster-Account, X-User-Agent
access-control-allow-origin: *
x-amz-cf-id: yz9PFlHV7XQTODVYXhXrW7M1eUF9_EAjAANjXosC_eAF7HrT6rdPnQ==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 54ms
54ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d7b144a39a2d1f833fd452dc44a83ea505f8946a426d177e2e99bc2efba44e48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:07 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37906
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Oct 2020 19:30:07 GMT

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame 9A32 0
0 122ms
38ms Document
text/html 52.85.32.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1178304.js?sv=6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.11 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-11.ham50.r.cloudfront.net
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Response headers

status: 200
content-type: text/html
content-length: 851
date: Mon, 05 Oct 2020 13:02:45 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
last-modified: Mon, 05 Oct 2020 11:02:22 GMT
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C1
x-amz-cf-id: qTByLggKrGjaRYJBoMEdJFBMEaR7KGzrilCSu6JG-wpqoy2V9lCNOA==
age: 1492043

GET
DATA 200
OK truncated
/ 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 json Show response
api.omappapi.com/v3/geolocate/ 559 B
965 B 143ms
142ms XHR
application/json 13.225.73.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v3/geolocate/json
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.73.109 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-73-109.fra2.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: 792535f637439a1232d8f830530ab994d27d0d015ef03e54d8fd439c17e636b0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
via: 1.1 ac0e9b19969df989a920e6d1b834d009.cloudfront.net (CloudFront)
x-cache-config: 0 0
x-amz-cf-pop: FRA2-C2
x-cache-status: BYPASS
x-cache: Miss from cloudfront
status: 200
content-length: 559
x-user-agent: standard--
server: Pagely Gateway/1.5.1
x-ratelimit-remaining: 999
content-type: application/json
access-control-allow-origin: *
x-ratelimit-reset: 1603395068
x-ratelimit-limit: 1000
x-pagely-debug: mainblock
x-amz-cf-id: he1ydnfLTTlvaq511Ltbj2XbrB4f-yyz1Y5LJCG5q8kaSoP2dLJuRw==

GET
H2 200 webfont.js Show response
a.omappapi.com/app/js/webfont/1.5.18/ 16 KB
7 KB 104ms
32ms Script
application/javascript 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/webfont/1.5.18/webfont.js
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 20:09:04 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 150598F21615D8E3
etag: W/"593e60ad549e46f8ca9a60755336c7df"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: VS6jMyDYuGBSrs+kNu57QzslaALXrQeZVXyTbUrxnBJDHMl2ha905GMwrhcN+OK/SgstnnHWXLg=
expires: Sun, 17 Oct 2021 19:30:08 GMT

GET
H2 200 moment.min.js Show response
a.omappapi.com/app/js/moment.js/2.24.0/ 52 KB
20 KB 122ms
50ms Script
application/javascript 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/moment.js/2.24.0/moment.min.js
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e22419e8154be2a34a950dbb4c4c448413751c53ef02f00c6c56af28aa2c4964

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 20:09:04 GMT
server: NetDNA-cache/2.2
x-amz-request-id: A1976B166879D4D1
etag: W/"761502841c035afcf6a9bdc5d0a20d11"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: RuPgLz2XK8jLQg7xFavH86se718KnydvfDIjRvs6wSFy5oyn8GhtkHX7HLhU7MAdEtQocG78l6w=
expires: Sun, 17 Oct 2021 19:30:08 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 860
date: Thu, 22 Oct 2020 19:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Thu, 22 Oct 2020 21:15:48 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
66 B 13ms
13ms XHR
text/plain 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1332116990&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&ul=en-us&de=UTF-8&dt=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%202&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=175844277&gjid=852678639&cid=598761301.1603395008&tid=UA-767980-1&_gid=328696209.1603395008&_r=1&gtm=2ouae1&z=1013423201

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:30:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/1178304/ 178 B
321 B 156ms
61ms XHR
application/json 34.255.46.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/1178304/visit-data?sv=6
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.8892a865463d29e21514.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.46.51 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-46-51.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: br
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true

GET
H2 200 moment-timezone-with-data-2012-2022.min.js Show response
a.omappapi.com/app/js/moment-timezone/0.5.23/ 32 KB
11 KB 34ms
34ms Script
application/javascript 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/moment-timezone/0.5.23/moment-timezone-with-data-2012-2022.min.js
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 23190e1539469cc8b5faccb038b260ccda2cc62672c70efa1900a51a8e3d1be5

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 20:09:04 GMT
server: NetDNA-cache/2.2
x-amz-request-id: F6245B6D2A53E3F6
etag: W/"fb7fbe56bb07e1bb4ead7d6ef061dbac"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: tYhuZQr4Bcsf852LVq0qh0/HiyAA+RMuDxA/qDPAjfgeqDONAU1T989CvxJVZTyPfljIwftTh20=
expires: Sun, 17 Oct 2021 19:30:08 GMT

GET
H2 200 RCf9ff76cf31c74379bd3f3a2cf11481b5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 1021 B
867 B 10ms
10ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RCf9ff76cf31c74379bd3f3a2cf11481b5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 6071bd6cb72a22908968609c8f71c3a4c35d8a800167fd458542a32780445252

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 601
expires: Thu, 22 Oct 2020 20:30:08 GMT

GET
H2 200 RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 819 B
768 B 10ms
10ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9d1b840480f23fb32f2a58063761424456b59f139d4609b5e7b0610dd2fc6237

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 502
expires: Thu, 22 Oct 2020 20:30:08 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 48ms
33ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cdebb9617bcda474bd09c07b66bf49608fc1606962c8e837bdd4124a552b6355

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37970
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Oct 2020 19:30:08 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 41ms
26ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

06182b83bd033b6cda0e4e82b71d11a78d7e8b2641fe10109708664a2ca08760

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37966
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Oct 2020 19:30:08 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
38 KB 40ms
25ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

504cb84b076d359d547193e04f2d82b90d79f7591c7218cad2fefda54a82ab02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37969
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Oct 2020 19:30:08 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 51ms
37ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f7453f56f31ea4a02de5fa02b986a20224ff7463d7bdeb19810e6c4edd02a6e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37951
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Oct 2020 19:30:08 GMT

GET
H2 200 RC0a0605f4b42e425fa678ffc6c2d94fb3-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 847 B
744 B 9ms
9ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RC0a0605f4b42e425fa678ffc6c2d94fb3-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a7f564316dc7303685d94451d6c9fc9dae613ec562b18a91c04ef32a63bd994

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 477
expires: Thu, 22 Oct 2020 20:30:08 GMT

GET
H2 200 RC7aad8f7422fa440982b5442a32fa8e4e-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 664 B
699 B 9ms
9ms Script
application/x-javascript 2a02:26f0:10c:5b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RC7aad8f7422fa440982b5442a32fa8e4e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5b1::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e3921284615c40654c9e00e3c672b92a639096d4d3712274184344b371fbfda7

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 400
x-akamai-path-stats: [1:978:4294966318]
expires: Thu, 22 Oct 2020 20:30:08 GMT

GET
H/1.1 200 ipinfo Show response
site.fortinet.com/utilservice/ 211 B
743 B 708ms
182ms Script
application/json 96.45.36.159
FORTINET

General

Check archive.org

Show headers Download Go to

Full URL

https://site.fortinet.com/utilservice/ipinfo?site=fortinet.com&callback=jQuery2200548393219640138_1603395004590&_=1603395004591

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.45.36.159 San Jose, United States, ASN40934 (FORTINET, US),

Reverse DNS

Software

nginx/1.14.0 /

Resource Hash

7d09dead5bf3ea5cd84263c99ae607c4f980a4e3e9bb744bfe5349efcff8d412

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .fortinet.com .myfortinet.com fortinet.my.salesforce.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' *.fortinet.com *.myfortinet.com fortinet.my.salesforce.com;
Server: nginx/1.14.0
Date: Thu, 22 Oct 2020 19:30:08 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/json;charset=UTF-8
Connection: keep-alive
Content-Length: 211
Front-End-Https: on

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 448ms
112ms Script
application/javascript 18.232.28.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.232.28.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-6-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:30:08 GMT
Content-Encoding: gzip
X-Pardot-Route: ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB: e95a292e477f6214c8e77c2cf881a7d3
Last-Modified: Fri, 13 Mar 2020 17:22:59 GMT
Server: PardotServer
ETag: "1442-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=63072000
Accept-Ranges: bytes
Content-Length: 1842
Expires: Sat, 22 Oct 2022 19:30:08 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 88 KB
23 KB 20ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23070
x-xss-protection: 0
pragma: public
x-fb-debug: Znh8G9Qy98DK0PeMVGEuqfGlrvupG7PHGp8pxhssolqEmCVVUsEEFWFauG56pW7sv8j/SM4vmvAawhtFZoWCzA==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Thu, 22 Oct 2020 19:30:08 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 99ms
32ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
age: 79056
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4057-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1603395008.367054,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
761 B 33ms
12ms Script
application/x-javascript 2a02:26f0:10c:58e::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:58e::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:30:08 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=60006
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ 26 KB
12 KB 200ms
51ms Script
application/javascript 34.249.122.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?229
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.122.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-122-179.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 7d655e8cd62ba58d86b3bc9c8e1e04a76506a4dfc852c3b3813deb0aef284548

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:30:08 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Oct 2020 05:54:09 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=37440
Connection: keep-alive
Content-Length: 11933
Expires: Fri, 23 Oct 2020 05:54:09 GMT

GET
H2 200 177020962864941 Show response
connect.facebook.net/signals/config/ 234 KB
69 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.27&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

50767a5dcab4f4ae0aa05bb3bf246815cb41da175707ac7a39c837ded7e89250

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 69831
x-xss-protection: 0
pragma: public
x-fb-debug: bDuJECpJiRj9TadyFlTjvBLoBTLB3f98IkEpzDMrHcgvifNXmZQHN9wyveSvPi4JjXtfLTC9MIX5oE1moxTj1w==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Thu, 22 Oct 2020 19:30:08 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 39 KB
13 KB 101ms
33ms Script
text/javascript 104.111.214.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.214.206 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-206.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: c248f8404721d961fff789b4916e8b2f3ac975ffde32bb370374814712055d59

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: j1Ukz68kZImBJrgt6DlzhQICmRxkgWbz
Content-Encoding: gzip
ETag: "505601f096ee8dbb7ca2aafa3009e00c"
x-amz-request-id: 4A30A1DF02B82D40
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 12342
x-amz-id-2: YGWnZLWp3a5Q/+XhlpjWllAZJKOHJKWeLtsAnTJqNwJQeVBUyMtnDCL6xRU42ao8VNLkNHGVEhY=
Last-Modified: Wed, 14 Oct 2020 20:21:11 GMT
Server: AmazonS3
Date: Thu, 22 Oct 2020 19:30:08 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 13ms
13ms Script
application/x-javascript 2a02:26f0:10c:58e::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:58e::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:30:08 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=78332
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1799

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 30 KB
12 KB 555ms
189ms Script
text/javascript 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

0bfb81a6d3e2ed2e0cb381a9f933355ff00e64cd0d80724e83559861cad12711

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11472
x-xss-protection: 0
server: cafe
etag: 8286593240961886057
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 22 Oct 2020 19:30:08 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
379 B 20ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&rl=&if=false&ts=1603395008416&sw=1600&sh=1200&v=2.9.27&r=stable&ec=0&o=30&fbp=fb.1.1603395008415.268403974&it=1603395008311&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 22 Oct 2020 19:30:08 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603395008417&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26time%3D1603395008417%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603395008417&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&liSync=true

0
57 B

136ms
136ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603395008417&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: d7/N60NnQBYA4gsZjCsAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: +pVy50NnQBZgvWDGvioAAA==
pragma: no-cache
x-li-pop: afd-prod-edc2
x-msedge-ref: Ref A: EF691AACCBF34E3684975E54E1A99ADC Ref B: FRAEDGE1408 Ref C: 2020-10-22T19:30:08Z
x-frame-options: sameorigin
date: Thu, 22 Oct 2020 19:30:08 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603395008417&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
650 B 253ms
166ms Script
application/javascript 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 125
pragma: no-cache
last-modified: Thu, 22 Oct 2020 19:30:08 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: a728f52b32d74bae3d341008fb4ad7ab
x-transaction: 00cba62b007f6829
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 237ms
155ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 115
pragma: no-cache
last-modified: Thu, 22 Oct 2020 19:30:08 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 7fc474925ed8d3d4897ca2996b8eac3f
x-transaction: 000ad09200e20258
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js
https://s.adroll.com/j/exp/index.js

28 B
790 B

32ms
32ms

Script
application/javascript

104.111.214.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.214.206 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-206.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 2U8XMvdFINXJNFsilaXONuSvqmREKV3.
Content-Encoding: gzip
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: 0A9DFB41B15EF3A2
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 48
x-amz-id-2: 9wtYzl8isf76a+KTcCc0hWCh/ZKrxXSL0KsmsoDDvS1VGgWl/GxdSe7DtPnOmbh4BH+84jF1nEY=
Last-Modified: Fri, 31 Jul 2020 16:11:15 GMT
Server: AmazonS3
Date: Thu, 22 Oct 2020 19:30:09 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Akamai-Path-Stats: [1:10716:4294957580]

Redirect headers

Date: Thu, 22 Oct 2020 19:30:09 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/ 1 KB
1 KB 123ms
59ms Script
text/javascript 104.111.214.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.214.206 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-206.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: bpn2g0nfhwaHsgxTQaV3aDBWotWIjBqp
Content-Encoding: gzip
ETag: "3996d65282dd996ee0d7d4c90c139158"
x-amz-request-id: A26C330740D6D3B1
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 635
x-amz-id-2: j5zeTonRqvcn/c0kEz06LGBCNuW6SZBgixaW4ksu0xdU3FVSf9sV490BUYOnpvadJwfsmMCkrFw=
Last-Modified: Thu, 22 Oct 2020 04:54:26 GMT
Server: AmazonS3
Date: Thu, 22 Oct 2020 19:30:08 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

/ Show response
d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/7OBVBCAQE5FHDPFEAD5T4D?_s=b6a8e899102542711464329e1642a62c&_b=2
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=b6a8e899102542711464329e1642a62c&_b=2

385 B
478 B

147ms
49ms

Script
application/javascript

54.171.111.254
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=b6a8e899102542711464329e1642a62c&_b=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.111.254 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-111-254.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: b709047120fe70d31c6b9a1fb9b3f47058944ec3293656e440636c1d04a1d99b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Thu, 22 Oct 2020 19:30:08 GMT
server: nginx/1.18.0
content-length: 385
content-type: application/javascript

Redirect headers

status: 302
date: Thu, 22 Oct 2020 19:30:08 GMT
server: nginx/1.18.0
content-length: 105
location: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=b6a8e899102542711464329e1642a62c&_b=2

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ 644 B
1 KB 52ms
52ms Script
application/javascript 34.249.122.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&pv=1603395008488_567ru1vvd&bl=en-us&cb=4884303&return=&ht=&d=&dc=&si=1603395008488_567ru1vvd&cid=&s=1600x1200&rp=
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?229
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.122.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-122-179.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 25038736ee81bf0daf59013a2f0ca9d49f7a0d327676f5d62251e249b2541e71

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 19:30:08 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 467
Expires: 0

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/
Redirect Chain

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3614007910639075400&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3614007910639075400&redir=

42 B
915 B

47ms
47ms

Image
image/gif

52.48.66.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3614007910639075400&redir=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.48.66.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-48-66-74.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v084-04461752a.edge-irl1.demdex.com 5.78.2.20201014153347 0ms (+2ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: kBNgjls6T18=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: vaIhTTR2QCw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3614007910639075400&redir=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3614007910639075400
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYxNDAwNzkxMDYzOTA3NTQwMBAAGg0IwbvH_AUSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=ce432b558997748e575ccce191d1a14658053083f5dd27b6e6da16f6d305c613f4cb09cee1a4f8eb&person_id=3614007910639075400&eid=50082

43 B
312 B

50ms
50ms

Image
image/gif

34.249.122.179
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=ce432b558997748e575ccce191d1a14658053083f5dd27b6e6da16f6d305c613f4cb09cee1a4f8eb&person_id=3614007910639075400&eid=50082
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.122.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-122-179.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:30:09 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Fri, 23 Oct 2020 15:30:09 GMT

Redirect headers

date: Thu, 22 Oct 2020 19:30:09 GMT
via: 1.1 google
status: 307
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ml314.com/csync.ashx?fp=ce432b558997748e575ccce191d1a14658053083f5dd27b6e6da16f6d305c613f4cb09cee1a4f8eb&person_id=3614007910639075400&eid=50082
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=3d20cb64-bd0c-4d82-82a9-38581b2c4015
https://ml314.com/csync.ashx?fp=3d20cb64-bd0c-4d82-82a9-38581b2c4015&person_id=3614007910639075400&eid=53819

43 B
312 B

108ms
54ms

Image
image/gif

34.249.122.179
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=3d20cb64-bd0c-4d82-82a9-38581b2c4015&person_id=3614007910639075400&eid=53819
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.122.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-122-179.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:30:08 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Fri, 23 Oct 2020 15:30:08 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 19:30:08 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Location: https://ml314.com/csync.ashx?fp=3d20cb64-bd0c-4d82-82a9-38581b2c4015&person_id=3614007910639075400&eid=53819
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0,Fri, 23 Oct 2020 15:30:08 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614007910639075400
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614007910639075400
https://ml314.com/csync.ashx?fp=a59825ebb8fcf81ee1a0bcf8a039ea6a&eid=50146&person_id=3614007910639075400

43 B
312 B

77ms
52ms

Image
image/gif

34.249.122.179
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=a59825ebb8fcf81ee1a0bcf8a039ea6a&eid=50146&person_id=3614007910639075400
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.122.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-122-179.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:30:08 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Fri, 23 Oct 2020 15:30:08 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:30:08 GMT
status: 302
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://ml314.com/csync.ashx?fp=a59825ebb8fcf81ee1a0bcf8a039ea6a&eid=50146&person_id=3614007910639075400
cache-control: no-cache
x-server: 10.45.25.42
content-length: 0
expires: 0

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif

0
344 B

32ms
32ms

Image
text/plain

3.125.70.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.125.70.222 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-70-222.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:30:08 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /pixel/bounce/?pid=r8hrb20&t=gif
Date: Thu, 22 Oct 2020 19:30:08 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H/1.0 200
OK analytics Show response
pi.pardot.com/ 2 KB
2 KB 330ms
329ms Script
text/javascript 18.232.28.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=14084&account_id=873291&title=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%202&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.232.28.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-6-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 93a9234461ddee912b86a4abdcb9728e93dcd9749cbc39afbb671479159d563f

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 19:30:08 GMT
Content-Encoding: gzip
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: e95a292e477f6214c8e77c2cf881a7d3
X-Pardot-Rsp: 17/13/134
Vary: Accept-Encoding,User-Agent
P3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 839
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK consent_tcfv2.js Show response
s.adroll.com/j/ 396 KB
55 KB 59ms
59ms Script
application/javascript 104.111.214.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent_tcfv2.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.214.206 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-206.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1e8c2c1c69e177db8aab839264b26577c44af29b75cc4edb25b5021b0b4538e3

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: RrXoTAgO8kW4lHaNUHggiN0CFoNQqBuA
Content-Encoding: gzip
ETag: "14827d9b396da2c054681d43b60bfefa"
x-amz-request-id: 75FD1CF45B5DC603
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 55061
x-amz-id-2: 87Hntk1FQ9KerNTzh7kaTiGto6MGiLc0tqz1MqvwTE4/+GFSHUx4QutWa2o433BEieeasynzIjM=
Last-Modified: Wed, 21 Oct 2020 17:43:14 GMT
Server: AmazonS3
Date: Thu, 22 Oct 2020 19:30:08 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK favicon-32x32.png
nextroll.com/ 2 KB
2 KB 351ms
116ms Image
image/png 52.87.143.234
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextroll.com/favicon-32x32.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.87.143.234 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache /
Resource Hash: bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:30:09 GMT
Via: 1.1 vegur
Last-Modified: Thu, 15 Oct 2020 16:16:02 GMT
Server: Apache
Etag: "64f-5b1b7f6d77480"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1615

POST
H2 200 /
www.facebook.com/tr/ 0
84 B 6ms
5ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryJOB44I1mbleuoLZU

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Thu, 22 Oct 2020 19:30:08 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.fortinet.com
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 2 KB
1 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1603395008944&cv=9&fst=1603395008944&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%202&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

97669d4070c8ea126c0464c1bca696591100eadf27cec5905b8da09ea0bcbfb0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1091
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 2 KB
1 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1603395008947&cv=9&fst=1603395008947&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%202&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

467e25de703df4d14205e3e83b260c2e979efebe1b7b9dbb571a39986599a624

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:30:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1091
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/662878185/ 42 B
107 B 23ms
21ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/662878185/?random=1603395008947&cv=9&fst=1603393200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%202&async=1&fmt=3&is_vtc=1&random=3832228405&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:30:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/662878185/ 42 B
560 B 40ms
20ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/662878185/?random=1603395008947&cv=9&fst=1603393200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%202&async=1&fmt=3&is_vtc=1&random=3832228405&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:30:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
326 B 21ms
20ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1603395008944&cv=9&fst=1603393200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%202&async=1&fmt=3&is_vtc=1&random=1970554539&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:30:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/609297413/ 42 B
107 B 42ms
22ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/609297413/?random=1603395008944&cv=9&fst=1603393200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%202&async=1&fmt=3&is_vtc=1&random=1970554539&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:30:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.0 200
OK analytics Show response
go.fortinet.com/ 52 B
1 KB 517ms
192ms Script
text/javascript 18.232.28.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://go.fortinet.com/analytics?conly=true&visitor_id=35949627&visitor_id_sign=c10c9766e3fea7e947dde0d16f926ce7ccd7b9ec6578c0b8de2c5a81d9dff3e9cf83665cd112995c3fd8013c0fbf9ae2ea296077&pi_opt_in=&campaign_id=14084&account_id=873291&title=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%202&url=https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=14084&account_id=873291&title=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%202&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-2&referrer=
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.232.28.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-6-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: eca19fb64be166fabab688d0cdb2ae946d3370f8124ff0f3f18119cc2d4eb825

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 19:30:09 GMT
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: e95a292e477f6214c8e77c2cf881a7d3
X-Pardot-Rsp: 16/24/208
Vary: User-Agent
P3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 52
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK imsync.ashx Show response
ml314.com/ 17 B
427 B 67ms
67ms Script
text/html 34.249.122.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/imsync.ashx?pi=3614007910639075400&data=eyJwaCI6MTA1MzIsIndoIjoxMjAwLCJ0YnMiOjAsImR0IjoxNSwicGlkIjoiMTYwMzM5NTAwODQ4OF81NjdydTF2dmQiLCJzZCI6MTIwMH0%3D
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?229
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.122.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-122-179.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 62ce950ad0d7f664b316b4253bbc993bf0bf8310970f64b150fda6f1fa59dfea

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:30:23 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Cache-Control: private
Connection: keep-alive
Content-Length: 135

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

195 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.addthis.com/	1970-01-19 22:53:33	Name: loc Value: MDAwMDBFVURLODIyMzYxMTkwMjAwMzAwMDBDSA==
www.fortinet.com/	1970-01-23 04:59:15	Name: visitor_id872291-hash Value: c10c9766e3fea7e947dde0d16f926ce7ccd7b9ec6578c0b8de2c5a81d9dff3e9cf83665cd112995c3fd8013c0fbf9ae2ea296077
.fortinet.com/	1970-01-19 15:32:51	Name: _fbp Value: fb.1.1603395008415.268403974
.fortinet.com/	1970-01-19 15:32:51	Name: _gcl_au Value: 1.1.1181003760.1603395008
www.fortinet.com/	1970-01-19 13:23:15	Name: _hjIncludedInSessionSample Value: 1
.fortinet.com/	1970-01-19 13:23:16	Name: aa_cc Value: DK
.fortinet.com/	1970-01-19 13:23:16	Name: _hjAbsoluteSessionInProgress Value: 0
.fortinet.com/	1970-01-19 13:23:15	Name: _gat_gtag_UA_767980_1 Value: 1
www.fortinet.com/	1970-01-19 13:23:15	Name: _omappvs Value: 1603395007801
.fortinet.com/	1970-01-19 13:24:41	Name: _gid Value: GA1.2.328696209.1603395008
.demdex.net/	1970-01-19 17:42:27	Name: demdex Value: 36478491845291719501970212979785848405
.fortinet.com/	1970-01-20 06:54:27	Name: _ga Value: GA1.2.598761301.1603395008
www.fortinet.com/	1970-01-19 13:23:15	Name: _hjIncludedInPageviewSample Value: 1
www.fortinet.com/	1970-01-23 04:59:15	Name: visitor_id872291 Value: 35949627
.fortinet.com/	1970-01-19 22:08:51	Name: _hjid Value: d44941ba-a2db-4a1b-8089-5f6f9865fa5a
www.fortinet.com/	1970-01-23 13:21:48	Name: _omappvp Value: paFaJGAfD0MxikGBUrzWj4AugDXyjwC6vbYptBvoZN7IqrOQHesW0RsdTWQAhKKndEOLGScfTtKlttbZ9yCsqECQnuoNRxTa
.addthis.com/	1970-01-19 22:53:33	Name: uvc Value: 1%7C43
.fortinet.com/	1969-12-31 23:59:59	Name: _hjTLDTest Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.omappapi.com
a.opmnstr.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
cm.everesttech.net
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
dpm.demdex.net
fortinet.demdex.net
go.fortinet.com
googleads.g.doubleclick.net
idsync.rlcdn.com
in.hotjar.com
m.addthis.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
nextroll.com
pi.pardot.com
ps.eyeota.net
px.ads.linkedin.com
s.adroll.com
s7.addthis.com
script.hotjar.com
site.fortinet.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
sync.crwdcntrl.net
t.co
v1.addthisedge.com
vars.hotjar.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
z.moatads.com
s7.addthis.com
104.111.214.206
104.111.216.96
104.244.42.131
104.244.42.197
13.225.73.109
13.56.33.144
15.237.136.106
151.101.112.157
172.217.21.226
18.232.28.189
23.111.11.182
23.111.11.71
23.210.248.44
2620:1ec:21::14
2a00:1450:4001:802::2002
2a00:1450:4001:802::2003
2a00:1450:4001:809::200e
2a00:1450:4001:819::2004
2a00:1450:4001:824::2008
2a02:26f0:10c:58e::25ea
2a02:26f0:10c:5b1::1e80
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
3.125.70.222
34.120.207.148
34.248.119.134
34.249.122.179
34.255.46.51
52.48.137.92
52.48.66.74
52.49.73.64
52.85.32.11
52.85.32.94
52.87.143.234
54.171.111.254
54.192.206.8
54.72.203.20
66.117.28.86
96.45.36.159
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
06182b83bd033b6cda0e4e82b71d11a78d7e8b2641fe10109708664a2ca08760
0bfb81a6d3e2ed2e0cb381a9f933355ff00e64cd0d80724e83559861cad12711
0ee86ed5cc3cc663964bf3d622e778902cccaaaa23ea8a6bc2c3ae268ec49d6e
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1240dad403c8c0dae31b46cf4219409e27275153dda4086c2dddc9d1ed42d131
133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
1c2896ac1d293a393f68006bf2c99bba800970abc1b127a4f6c57964c427ab58
1e4e963df26efc81406a308ba13b1020e933c9d38ef1c7d52c1575b6a35ff920
1e8c2c1c69e177db8aab839264b26577c44af29b75cc4edb25b5021b0b4538e3
20beb39b6d84166b10ddd97034b3eda4914934a89ab8ade555a9f20f9409b79a
23190e1539469cc8b5faccb038b260ccda2cc62672c70efa1900a51a8e3d1be5
25038736ee81bf0daf59013a2f0ca9d49f7a0d327676f5d62251e249b2541e71
35833466352a77a63951e175a39d77dff813bc8ad865270c67ff7338ab9a36e0
35a158350cb0c9e4589f0051518c7205622d66b0cf77c8ca2044c7ff23a6e8d1
43b2db2fa1fdf8a98142afb6f8566ae849be0002dd755683bf707a10a4e99f60
467e25de703df4d14205e3e83b260c2e979efebe1b7b9dbb571a39986599a624
504cb84b076d359d547193e04f2d82b90d79f7591c7218cad2fefda54a82ab02
50767a5dcab4f4ae0aa05bb3bf246815cb41da175707ac7a39c837ded7e89250
53bc3e09acc2c8d8f769c7c789b58a5e23d1e1f123e10379d1690c408182701f
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
6071bd6cb72a22908968609c8f71c3a4c35d8a800167fd458542a32780445252
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd
62ce950ad0d7f664b316b4253bbc993bf0bf8310970f64b150fda6f1fa59dfea
6748364feee8081655210f98e7d769bc02d297e1bf32e8022eb172fb1dacc3a2
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
71aa1b3adc87bcef41d1d4f251e6f9a0f586c4b9025d3c8f873dfa5aa3774d1f
792535f637439a1232d8f830530ab994d27d0d015ef03e54d8fd439c17e636b0
7b629f4dac3d245066275be536f9d424fef26b751adba1c9f536e43bdd92d856
7d09dead5bf3ea5cd84263c99ae607c4f980a4e3e9bb744bfe5349efcff8d412
7d655e8cd62ba58d86b3bc9c8e1e04a76506a4dfc852c3b3813deb0aef284548
7ef0ff6db29fbb95501a2bbcbcb741474fa3cb3511009901a2fe7369084ae234
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
839c8187f44daed8f92e33e0f77136b26436f8f92a863536b65cf2a94f7e4881
8742b3448ac5ce571142fbed237512dd79ccf759472eb5186da17c5c6009cba7
918abef382f3aa12111b9be55aa6f5f6557439e95563a274f01b0bbe063435bd
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8
93a9234461ddee912b86a4abdcb9728e93dcd9749cbc39afbb671479159d563f
96b7353cfc0c512962840bc951b0e1009d3419defac1a37a7b1149e8ea3d43cc
97669d4070c8ea126c0464c1bca696591100eadf27cec5905b8da09ea0bcbfb0
97e95fcc66a29acfd27e371656c24da14947aace63dfa4db95fa8482f8bfb4bc
9a7f564316dc7303685d94451d6c9fc9dae613ec562b18a91c04ef32a63bd994
9ce9e23b2f0aff01f3a20cde4e99e014e306dfb3c420bee920ea9e0f323a6ccc
9d1b840480f23fb32f2a58063761424456b59f139d4609b5e7b0610dd2fc6237
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a35755220eca4f3d10ee29cf3f145e59f963cf3c4c45ed2f19994b987ef185d2
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad3e85ce77ea499a5d5c5815b536337c4305e3801a09572efd49010287cf9df0
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6c29512b7d321aa70701ef365f1f6c7ea25dff345206a54e5304216135f3e38
b709047120fe70d31c6b9a1fb9b3f47058944ec3293656e440636c1d04a1d99b
b9c55c23ca137f163542ae6e8e3c0e2bf193d9e9d0cf3678bd2e7b4eb3763072
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
c248f8404721d961fff789b4916e8b2f3ac975ffde32bb370374814712055d59
c35f165a558d326d2f43762f0586fffe0be8b03f01e7093efeefadc06fb17e72
cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d
cdebb9617bcda474bd09c07b66bf49608fc1606962c8e837bdd4124a552b6355
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
d15548f7fd31c9e601349c206aa012baff6e50ca2218a63d62a29429d31ecf59
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
d7b144a39a2d1f833fd452dc44a83ea505f8946a426d177e2e99bc2efba44e48
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e22419e8154be2a34a950dbb4c4c448413751c53ef02f00c6c56af28aa2c4964
e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca
e3921284615c40654c9e00e3c672b92a639096d4d3712274184344b371fbfda7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
eca19fb64be166fabab688d0cdb2ae946d3370f8124ff0f3f18119cc2d4eb825
ed6e7dbac93a75b3f75a6bf57a607ff555dc436254c28ede3aa2bd12d16b9dcf
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f692ee03941001acfb64ab453b8ad134f6d8b8927d29ef586ef052d848878cfd
f7453f56f31ea4a02de5fa02b986a20224ff7463d7bdeb19810e6c4edd02a6e7
fa1aff33ee6e46f4105be4d25f9241e69116def9d2b1413d692acde88e27d5ef
fc5b6932c605af2013fb5ad7fb59d30d267a8a7623c352d1fddffe88bfce84ea

www.fortinet.com Open in urlscan Pro 13.56.33.144 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

93 Requests

99 %HTTPS

28 %IPv6

32 Domains

43 Subdomains

35 IPs

6 Countries

2012 kBTransfer

4434 kBSize

18 Cookies

14 Outgoing links

Page URL History

Redirected requests

93 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.fortinet.com Open in urlscan Pro
13.56.33.144 Public Scan

Screenshot
Live screenshot

Full Image

93
Requests

99 %
HTTPS

28 %
IPv6

32
Domains

43
Subdomains

35
IPs

6
Countries

2012 kB
Transfer

4434 kB
Size

18
Cookies

93 HTTP transactions
2 data transactions