www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1702:852f:d87f:6683:b05a Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Submission: On February 21 via api (February 21st 2025, 6:47:19 am UTC) from IN — Scanned from US

Summary HTTP 232 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 77 IPs in 2 countries across 64 domains to perform 232 HTTP transactions. The main IP is 2600:1f18:1492:1702:852f:d87f:6683:b05a, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 129117.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 16th 2024. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
44	2600:1f18:149... 2600:1f18:1492:1702:852f:d87f:6683:b05a	14618 (AMAZON-AES) (AMAZON-AES)
11	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	2600:141b:f00... 2600:141b:f000:c0b4::1e80	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1 4	44.208.97.160 44.208.97.160	14618 (AMAZON-AES) (AMAZON-AES)
1	3.95.113.145 3.95.113.145	14618 (AMAZON-AES) (AMAZON-AES)
1 1	44.235.160.192 44.235.160.192	16509 (AMAZON-02) (AMAZON-02)
1	63.140.38.189 63.140.38.189	14618 (AMAZON-AES) (AMAZON-AES)
3	2600:9000:23c... 2600:9000:23cb:3400:a:6e64:b280:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:33::10 2620:1ec:33::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
8	2607:f8b0:400... 2607:f8b0:4006:820::2008	15169 (GOOGLE) (GOOGLE)
4	2600:9000:21d... 2600:9000:21da:fc00:1f:d9e6:d540:93a1	16509 (AMAZON-02) (AMAZON-02)
4	104.19.147.8 104.19.147.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	23.34.59.33 23.34.59.33	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
3	23.41.169.82 23.41.169.82	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.86.110.8 34.86.110.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	64.202.112.31 64.202.112.31	23352 (SERVERCEN...) (SERVERCENTRAL)
1	2600:141b:f00... 2600:141b:f000:36::1728:129e	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
4	3.220.146.83 3.220.146.83	14618 (AMAZON-AES) (AMAZON-AES)
2	99.83.231.3 99.83.231.3	16509 (AMAZON-02) (AMAZON-02)
1	63.140.39.22 63.140.39.22	14618 (AMAZON-AES) (AMAZON-AES)
4	142.251.40.164 142.251.40.164	15169 (GOOGLE) (GOOGLE)
1 4	142.251.40.194 142.251.40.194	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4006:81e::2002	15169 (GOOGLE) (GOOGLE)
2	142.251.40.200 142.251.40.200	15169 (GOOGLE) (GOOGLE)
1	142.251.40.166 142.251.40.166	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:809::200e	15169 (GOOGLE) (GOOGLE)
3	2a02:6ea0:c45... 2a02:6ea0:c454::1	60068 (CDN77 Dat...) (CDN77 Datacamp Limited)
2	3.133.162.222 3.133.162.222	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:309	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.1.91 151.101.1.91	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:1347	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.32.164.86 52.32.164.86	16509 (AMAZON-02) (AMAZON-02)
1	216.200.232.253 216.200.232.253	30419 (PAEDAE-INC) (PAEDAE-INC)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a04:4e42:400... 2a04:4e42:400::485	54113 (FASTLY) (FASTLY)
2	44.226.187.177 44.226.187.177	16509 (AMAZON-02) (AMAZON-02)
3	2602:816:5001... 2602:816:5001::39	54113 (FASTLY) (FASTLY)
1	34.238.149.65 34.238.149.65	14618 (AMAZON-AES) (AMAZON-AES)
1	146.75.32.157 146.75.32.157	54113 (FASTLY) (FASTLY)
1	2600:141b:f00... 2600:141b:f000:1e::1737:f346	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
7	44.218.226.74 44.218.226.74	14618 (AMAZON-AES) (AMAZON-AES)
1 2	68.67.179.166 68.67.179.166	29990 (ASN-APPNEX) (ASN-APPNEX)
1 3	68.67.160.184 68.67.160.184	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:21f... 2600:9000:21f9:1200:12:dfa9:e200:93a1	16509 (AMAZON-02) (AMAZON-02)
20 23	35.236.220.17 35.236.220.17	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	2600:9000:284... 2600:9000:2840:4a00:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	70.42.32.191 70.42.32.191	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	69.194.240.13 69.194.240.13	26120 (RHYTHMONE) (RHYTHMONE)
1 2	35.71.139.29 35.71.139.29	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f10:4ce... 2600:1f10:4ce4:4a05:565e:7dc2:ecda:d7b1	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	108.138.128.83 108.138.128.83	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:21d... 2600:9000:21da:600:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2600:9000:284... 2600:9000:2840:8000:1b:6b7d:2300:93a1	16509 (AMAZON-02) (AMAZON-02)
1	207.65.37.184 207.65.37.184	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	63.251.28.230 63.251.28.230	26558 (FREEWHEEL) (FREEWHEEL)
2 3	2600:1901:0:8... 2600:1901:0:8eee::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	2001:4998:14:... 2001:4998:14:800::1000	14777 (YAHOO) (YAHOO)
2 3	2001:4998:14:... 2001:4998:14:800::1001	14777 (YAHOO) (YAHOO)
1 2	52.0.156.250 52.0.156.250	14618 (AMAZON-AES) (AMAZON-AES)
1	52.202.191.63 52.202.191.63	14618 (AMAZON-AES) (AMAZON-AES)
1 2	44.223.125.1 44.223.125.1	14618 (AMAZON-AES) (AMAZON-AES)
1 2	52.55.40.41 52.55.40.41	14618 (AMAZON-AES) (AMAZON-AES)
2 2	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	107.178.254.65 107.178.254.65	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4 7	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
1	69.173.146.5 69.173.146.5	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	142.251.41.2 142.251.41.2	15169 (GOOGLE) (GOOGLE)
1	54.203.236.163 54.203.236.163	16509 (AMAZON-02) (AMAZON-02)
3	162.247.243.29 162.247.243.29	54113 (FASTLY) (FASTLY)
3	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	142.250.80.102 142.250.80.102	15169 (GOOGLE) (GOOGLE)
2	31.13.65.7 31.13.65.7	32934 (FACEBOOK) (FACEBOOK)
1	104.21.16.1 104.21.16.1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.212.39.155 3.212.39.155	14618 (AMAZON-AES) (AMAZON-AES)
1	3.223.133.185 3.223.133.185	14618 (AMAZON-AES) (AMAZON-AES)
2	31.13.65.36 31.13.65.36	32934 (FACEBOOK) (FACEBOOK)
2	35.85.106.161 35.85.106.161	16509 (AMAZON-02) (AMAZON-02)
1	35.81.162.201 35.81.162.201	16509 (AMAZON-02) (AMAZON-02)
3 3	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
1	54.244.159.189 54.244.159.189	16509 (AMAZON-02) (AMAZON-02)
1 1	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
232	77

44 2600:1f18:1492:1702:852f:d87f:6683:b05a (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2600:141b:f000:c0b4::1e80 (Edison, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 44.208.97.160 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-208-97-160.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.95.113.145 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-95-113-145.compute-1.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.235.160.192 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-44-235-160-192.us-west-2.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.38.189 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-189.data.adobedc.net

fortinet.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:23cb:3400:a:6e64:b280:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.schemaapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2607:f8b0:4006:820::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:21da:fc00:1f:d9e6:d540:93a1 (United States)

ASN16509 (AMAZON-02, US)

data.schemaapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.19.147.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 23.34.59.33 (Edison, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-34-59-33.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.41.169.82 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-41-169-82.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wave.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.86.110.8 (Washington, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.110.86.34.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.202.112.31 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:f000:36::1728:129e (Edison, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.220.146.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-146-83.compute-1.amazonaws.com

api.schemaapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.231.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.22 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-22.data.adobedc.net

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.40.164 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s81-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.40.194 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s38-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:81e::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.40.200 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s38-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.166 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s81-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:809::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:6ea0:c454::1 (New York, United States)

ASN60068 (CDN77 Datacamp Limited, GB)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.133.162.222 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-133-162-222.us-east-2.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:309 (United States)

ASN13335 (CLOUDFLARENET, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.91 (San Francisco, United States)

ASN54113 (FASTLY, US)

client-registry.mutinycdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1347 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.32.164.86 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-164-86.us-west-2.compute.amazonaws.com

abm-tracking.demandscience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.200.232.253 (Frederick, United States)

ASN30419 (PAEDAE-INC, US)

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.226.187.177 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-226-187-177.us-west-2.compute.amazonaws.com

intentstream.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2602:816:5001::39 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.238.149.65 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-238-149-65.compute-1.amazonaws.com

dx.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.32.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:f000:1e::1737:f346 (Edison, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 44.218.226.74 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-218-226-74.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.179.166 (North Bergen, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.67.160.184 (Colonia, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f9:1200:12:dfa9:e200:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.inzynk.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 35.236.220.17 (Washington, United States) 20 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 17.220.236.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2840:4a00:1b:5138:8a40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.42.32.191 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.194.240.13 (United States)

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.139.29 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f10:4ce4:4a05:565e:7dc2:ecda:d7b1 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.128.83 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-83.jfk50.r.cloudfront.net

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21da:600:19:fc2c:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2840:8000:1b:6b7d:2300:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 207.65.37.184 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.251.28.230 (Secaucus, United States)

ASN26558 (FREEWHEEL, US)

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbid.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:14:800::1000 (United States) 1 redirects

ASN14777 (YAHOO, US)

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4998:14:800::1001 (United States) 2 redirects

ASN14777 (YAHOO, US)

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.0.156.250 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-156-250.compute-1.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.202.191.63 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-191-63.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.223.125.1 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-223-125-1.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.55.40.41 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-55-40-41.compute-1.amazonaws.com

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.178.254.65 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.130 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.146.5 (United States)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.41.2 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s40-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.203.236.163 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-236-163.us-west-2.compute.amazonaws.com

tracking.contanuity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.247.243.29 (United States)

ASN54113 (FASTLY, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.80.102 (Plainview, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s36-in-f6.1e100.net

10104846.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.65.7 (Lithia Springs, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-atl3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.16.1 (None, )

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.212.39.155 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-212-39-155.compute-1.amazonaws.com

3.212.39.155	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.223.133.185 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-133-185.compute-1.amazonaws.com

6033413.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.65.36 (Lithia Springs, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-atl3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.85.106.161 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-85-106-161.us-west-2.compute.amazonaws.com

px.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.81.162.201 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-81-162-201.us-west-2.compute.amazonaws.com

gs.mountain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.71.131.137 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.244.159.189 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-244-159-189.us-west-2.compute.amazonaws.com

px.steelhousemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.197.193.217 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
45	fortinet.com www.fortinet.com — Cisco Umbrella Rank: 129117 metrics.fortinet.com — Cisco Umbrella Rank: 341027	1 MB
25	simpli.fi 20 redirects tag.simpli.fi — Cisco Umbrella Rank: 4929 i.simpli.fi — Cisco Umbrella Rank: 4611 um.simpli.fi — Cisco Umbrella Rank: 870	14 KB
22	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 457	154 KB
16	6sc.co j.6sc.co — Cisco Umbrella Rank: 5437 c.6sc.co — Cisco Umbrella Rank: 6449 ipv6.6sc.co — Cisco Umbrella Rank: 5584 b.6sc.co — Cisco Umbrella Rank: 3374	22 KB
12	doubleclick.net 3 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 44 td.doubleclick.net — Cisco Umbrella Rank: 178 ad.doubleclick.net — Cisco Umbrella Rank: 150 cm.g.doubleclick.net — Cisco Umbrella Rank: 290 10104846.fls.doubleclick.net — Cisco Umbrella Rank: 382659	6 KB
11	schemaapp.com cdn.schemaapp.com — Cisco Umbrella Rank: 12473 data.schemaapp.com — Cisco Umbrella Rank: 17039 api.schemaapp.com — Cisco Umbrella Rank: 50918	25 KB
11	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 353	171 KB
10	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	853 KB
8	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 342 www.linkedin.com — Cisco Umbrella Rank: 683 px4.ads.linkedin.com — Cisco Umbrella Rank: 6681	4 KB
7	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 2639	10 KB
6	outbrain.com amplify.outbrain.com — Cisco Umbrella Rank: 3217 wave.outbrain.com — Cisco Umbrella Rank: 3234 tr.outbrain.com — Cisco Umbrella Rank: 3198 sync.outbrain.com — Cisco Umbrella Rank: 951	11 KB
6	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2457 tracking.crazyegg.com — Cisco Umbrella Rank: 4605	42 KB
5	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 504 ib.adnxs.com — Cisco Umbrella Rank: 284	5 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 269 fortinet.demdex.net — Cisco Umbrella Rank: 377735	3 KB
4	adsrvr.org 4 redirects match.adsrvr.org — Cisco Umbrella Rank: 377 insight.adsrvr.org — Cisco Umbrella Rank: 982	2 KB
4	yahoo.com 3 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 1862 ups.analytics.yahoo.com — Cisco Umbrella Rank: 553	1 KB
4	mountain.com dx.mountain.com — Cisco Umbrella Rank: 4705 px.mountain.com — Cisco Umbrella Rank: 4889 gs.mountain.com — Cisco Umbrella Rank: 10230	11 KB
4	google.com www.google.com — Cisco Umbrella Rank: 3	192 B
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 1075	820 B
3	t.co t.co — Cisco Umbrella Rank: 1003	1 KB
3	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 278	1 KB
3	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2603 pbid.pro-market.net — Cisco Umbrella Rank: 11073	1 KB
3	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 689	55 KB
3	contanuity.com intentstream.contanuity.com — Cisco Umbrella Rank: 88964 tracking.contanuity.com — Cisco Umbrella Rank: 22388	1 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 27310 ibc-flow.techtarget.com — Cisco Umbrella Rank: 24509	2 KB
3	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 6883 api.omappapi.com — Cisco Umbrella Rank: 6896	3 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 375	15 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 125	216 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 197	76 KB
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 519	505 B
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 486	832 B
2	lijit.com 1 redirects ce.lijit.com — Cisco Umbrella Rank: 899	895 B
2	crwdcntrl.net 1 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 1088	784 B
2	exelator.com 1 redirects loadm.exelator.com — Cisco Umbrella Rank: 2184	2 KB
2	intentiq.com 1 redirects sync.intentiq.com — Cisco Umbrella Rank: 1069	2 KB
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 555 d.agkn.com — Cisco Umbrella Rank: 799	1 KB
2	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 469	1 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 438	970 B
2	demandscience.com abm-tracking.demandscience.com — Cisco Umbrella Rank: 86325	3 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 8962	666 B
1	steelhousemedia.com px.steelhousemedia.com — Cisco Umbrella Rank: 14504	319 B
1	siteimproveanalytics.io 6033413.global.siteimproveanalytics.io — Cisco Umbrella Rank: 371433	210 B
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3557	12 KB
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 433	1 KB
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 93	23 B
1	pippio.com 1 redirects pippio.com — Cisco Umbrella Rank: 795	633 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1317	421 B
1	stickyadstv.com ads.stickyadstv.com — Cisco Umbrella Rank: 635	654 B
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 924	513 B
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 7252	175 B
1	1rx.io sync.1rx.io — Cisco Umbrella Rank: 506	99 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 686	534 B
1	inzynk.io tags.inzynk.io — Cisco Umbrella Rank: 211798	428 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 874	15 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 1112	16 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 325	14 KB
1	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 3647	711 B
1	mutinycdn.com client-registry.mutinycdn.com — Cisco Umbrella Rank: 19425	21 KB
1	opmnstr.com a.opmnstr.com — Cisco Umbrella Rank: 35016	17 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 37
1	omtrdc.net fortinet.tt.omtrdc.net — Cisco Umbrella Rank: 357138	1 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1542	490 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 528	309 B
0	bluekai.com Failed stags.bluekai.com Failed
232	64

	Domain	Requested by
44	www.fortinet.com	www.fortinet.com
23	um.simpli.fi	20 redirects
22	assets.adobedtm.com	www.fortinet.com
13	b.6sc.co	www.fortinet.com
11	cdn.cookielaw.org	www.fortinet.com
10	www.googletagmanager.com	www.fortinet.com www.googletagmanager.com
7	tags.srv.stackadapt.com	www.fortinet.com js-agent.newrelic.com
6	px.ads.linkedin.com	3 redirects www.fortinet.com
4	td.doubleclick.net	www.fortinet.com
4	googleads.g.doubleclick.net	1 redirects www.fortinet.com
4	www.google.com	www.googletagmanager.com www.fortinet.com
4	api.schemaapp.com	www.fortinet.com
4	script.crazyegg.com	www.fortinet.com script.crazyegg.com
4	data.schemaapp.com	www.fortinet.com
4	dpm.demdex.net	1 redirects www.fortinet.com
3	match.adsrvr.org	3 redirects
3	analytics.twitter.com
3	t.co
3	bam.nr-data.net	www.fortinet.com
3	ups.analytics.yahoo.com	2 redirects
3	ib.adnxs.com	1 redirects
3	js-agent.newrelic.com	www.fortinet.com
3	bat.bing.com	www.fortinet.com
3	cdn.schemaapp.com	www.fortinet.com
2	px.mountain.com	www.fortinet.com
2	www.facebook.com
2	connect.facebook.net	www.fortinet.com
2	10104846.fls.doubleclick.net	1 redirects www.fortinet.com
2	us-u.openx.net	1 redirects
2	idsync.rlcdn.com	2 redirects
2	ce.lijit.com	1 redirects
2	bcp.crwdcntrl.net	1 redirects
2	loadm.exelator.com	1 redirects
2	fei.pro-market.net	2 redirects
2	sync.intentiq.com	1 redirects
2	pixel.tapad.com	1 redirects
2	eb2.3lift.com	1 redirects
2	secure.adnxs.com	1 redirects
2	intentstream.contanuity.com	www.fortinet.com
2	ibc-flow.techtarget.com	www.fortinet.com
2	abm-tracking.demandscience.com	www.fortinet.com
2	a.omappapi.com	www.fortinet.com js-agent.newrelic.com
2	tracking.crazyegg.com	script.crazyegg.com
2	epsilon.6sense.com	www.fortinet.com
2	tr.outbrain.com	www.fortinet.com
2	amplify.outbrain.com	www.fortinet.com
1	insight.adsrvr.org	1 redirects
1	px.steelhousemedia.com
1	gs.mountain.com	www.fortinet.com
1	6033413.global.siteimproveanalytics.io
1	siteimproveanalytics.com	www.fortinet.com
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	tracking.contanuity.com	www.fortinet.com
1	cm.g.doubleclick.net	1 redirects
1	pixel.rubiconproject.com
1	www.googleadservices.com	1 redirects
1	pippio.com	1 redirects
1	sync.bfmio.com
1	pbid.pro-market.net
1	cms.analytics.yahoo.com	1 redirects
1	ads.stickyadstv.com
1	image2.pubmatic.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.1rx.io
1	sync.outbrain.com
1	s.ad.smaato.net	1 redirects
1	tags.inzynk.io	www.fortinet.com
1	snap.licdn.com	www.fortinet.com
1	static.ads-twitter.com	www.fortinet.com
1	dx.mountain.com	www.fortinet.com
1	i.simpli.fi	www.fortinet.com
1	cdn.jsdelivr.net	www.fortinet.com
1	pixel.mathtag.com	www.fortinet.com
1	trk.techtarget.com	www.fortinet.com
1	client-registry.mutinycdn.com	www.fortinet.com
1	api.omappapi.com	www.fortinet.com
1	a.opmnstr.com	www.fortinet.com
1	www.google-analytics.com	www.fortinet.com
1	ad.doubleclick.net	www.fortinet.com
1	metrics.fortinet.com	www.fortinet.com
1	ipv6.6sc.co	www.fortinet.com
1	c.6sc.co	www.fortinet.com
1	wave.outbrain.com	www.fortinet.com
1	tag.simpli.fi	www.fortinet.com
1	j.6sc.co	www.fortinet.com
1	fortinet.tt.omtrdc.net	www.fortinet.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	www.fortinet.com
1	geolocation.onetrust.com	www.fortinet.com
0	stags.bluekai.com Failed
232	93

This site contains links to these domains. Also see Links.

Domain
training.fortinet.com
www.linkedin.com
www.x.com
www.youtube.com
www.instagram.com
www.facebook.com
fortiguard.com
community.fortinet.com
investor.fortinet.com
www.onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-16` - `2025-07-15`	a year	crt.sh
cookielaw.org WE1	`2025-02-06` - `2025-05-07`	3 months	crt.sh
geolocation.onetrust.com WE1	`2025-02-06` - `2025-05-07`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
cdn.schemaapp.com Amazon RSA 2048 M03	`2024-11-27` - `2025-12-25`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 08	`2024-12-15` - `2025-06-13`	6 months	crt.sh
*.google-analytics.com WR2	`2025-02-03` - `2025-04-28`	3 months	crt.sh
*.schemaapp.com Amazon RSA 2048 M02	`2024-08-20` - `2025-09-17`	a year	crt.sh
script.crazyegg.com E5	`2025-01-25` - `2025-04-25`	3 months	crt.sh
6sc.co R11	`2024-12-20` - `2025-03-20`	3 months	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2024-12-09` - `2025-12-09`	a year	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-11-13` - `2025-12-14`	a year	crt.sh
epsilon.6sense.com Amazon RSA 2048 M02	`2024-10-02` - `2025-11-01`	a year	crt.sh
metrics.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-12-27` - `2026-01-27`	a year	crt.sh
*.google.com WR2	`2025-02-03` - `2025-04-28`	3 months	crt.sh
*.g.doubleclick.net WR2	`2025-02-03` - `2025-04-28`	3 months	crt.sh
*.doubleclick.net WR2	`2025-02-03` - `2025-04-28`	3 months	crt.sh
a.opmnstr.com R10	`2025-02-01` - `2025-05-02`	3 months	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-06-30` - `2025-07-30`	a year	crt.sh
a.omappapi.com R11	`2025-02-01` - `2025-05-02`	3 months	crt.sh
omappapi.com WE1	`2025-02-08` - `2025-05-09`	3 months	crt.sh
client-registry.mutinycdn.com GlobalSign Atlas R3 DV TLS CA 2024 Q4	`2025-01-07` - `2026-02-08`	a year	crt.sh
trk.techtarget.com WE1	`2025-01-16` - `2025-04-16`	3 months	crt.sh
abm-tracking.demandscience.com R10	`2025-02-10` - `2025-05-11`	3 months	crt.sh
*.mathtag.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-04-23` - `2025-04-30`	a year	crt.sh
ibc-flow.techtarget.com WR3	`2025-02-15` - `2025-05-16`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
intentstream.contanuity.com E5	`2025-02-15` - `2025-05-16`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2025 Q1	`2025-01-22` - `2026-02-23`	a year	crt.sh
*.mountain.com Go Daddy Secure Certificate Authority - G2	`2024-05-23` - `2025-06-24`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2024-12-02` - `2025-12-01`	a year	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M03	`2024-08-09` - `2025-09-06`	a year	crt.sh
*.inzynk.io Amazon RSA 2048 M02	`2024-12-07` - `2026-01-05`	a year	crt.sh
tracking.contanuity.com R11	`2025-01-10` - `2025-04-10`	3 months	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-12` - `2025-08-12`	a year	crt.sh
t.co E5	`2025-01-24` - `2025-04-24`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-09` - `2025-10-08`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-11-30` - `2025-02-28`	3 months	crt.sh
siteimproveanalytics.com WE1	`2025-02-12` - `2025-05-13`	3 months	crt.sh
3.212.39.155 Sectigo RSA Domain Validation Secure Server CA	`2025-01-28` - `2026-02-15`	a year	crt.sh
*.global.r1.siteimproveanalytics.io Amazon RSA 2048 M03	`2025-01-20` - `2026-02-18`	a year	crt.sh

This page contains 9 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Frame ID: 57A48226FC504B3FA8D34349002B47DA
Requests: 215 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 90C5230DDFB442FFECA9EC856E175ABE
Requests: 1 HTTP requests in this frame

Frame: https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Frame ID: 9ED9FD527D6A28F3CCCC1627A3815F2B
Requests: 3 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/662878185?random=1740120429890&cv=11&fst=1740120429890&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52k0v887005625za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732279~101732281~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: D7B94E2ADFB8BB2DBBCAE47CB4A1CFF9
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/5230/sw_iframe.html?origin=https%3A%2F%2Fwww.fortinet.com
Frame ID: 0FB71ACB3B6F9F8507C4C04D71D9B3AC
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/609297413?random=1740120429996&cv=11&fst=1740120429996&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52k0za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732279~101732281~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: D8BA6AE6177E2BCAA10BFDB1D4A7EDCD
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=82586790.1740120430;ps=1;pcor=1000675094;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe52k0v9185241837za200zb893708426;gcd=13l3l3l3l1l1;dma=0;tag_exp=101732282~101732284~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant
Frame ID: FF2D283A85129D31AC7480CA1D0341C4
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/729495989?random=1740120430131&cv=11&fst=1740120430131&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52k0za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732282~101732284~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view
Frame ID: 03136344C7B5893F1174808E6E78798B
Requests: 1 HTTP requests in this frame

Frame: https://10104846.fls.doubleclick.net/activityi;dc_pre=CL_uo-KV1IsDFdpkRwEd14IMSA;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3182714311601.0938
Frame ID: 16A558BD4B396A2011B4404B921E2BFC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FortiSandbox 5.0 Detects Evolving Snake Keylogger Variant | FortiGuard Labs

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

FingerprintJS (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/fingerprintjs@(\d)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Highlight.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/(?:([\d.])+/)?highlight(?:\.min)?\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

232
Requests

87 %
HTTPS

30 %
IPv6

64
Domains

93
Subdomains

77
IPs

2
Countries

3055 kB
Transfer

8230 kB
Size

117
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://training.fortinet.com/local/staticpage/view.php?page=fcf_cybersecurity
Title: Fortinet Certified Fundamentals (FCF)

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.x.com/Fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fortinet/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://community.fortinet.com/
Title: Fortinet Community

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43

https://cm.everesttech.net/cm/dd?d_uuid=18216757739523472551750050414122619760 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Z7ghbAAAAIYwtgM0

Request Chain 159

https://secure.adnxs.com/px?id=1773420&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Request Chain 160

https://ib.adnxs.com/seg?add=36113683 HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Request Chain 162

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=3AAE8C15F97A41BB8B168E31745C5051

Request Chain 163

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=3AAE8C15F97A41BB8B168E31745C5051 HTTP 302
https://sync.outbrain.com/cookie-sync?p=smaato&initiation=partner&uid=1c670409b4&gdpr=0&gdpr_consent=

Request Chain 164

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/3AAE8C15F97A41BB8B168E31745C5051

Request Chain 165

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=3AAE8C15F97A41BB8B168E31745C5051&dongle=yf3 HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=3AAE8C15F97A41BB8B168E31745C5051&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

Request Chain 166

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=3AAE8C15F97A41BB8B168E31745C5051

Request Chain 167

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=3AAE8C15F97A41BB8B168E31745C5051 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=3AAE8C15F97A41BB8B168E31745C5051

Request Chain 168

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=3AAE8C15F97A41BB8B168E31745C5051 HTTP 302
https://d.agkn.com/pixel/10751/?che=1740120433208&ip=162.245.206.249&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D214760605165006269605 HTTP 302
https://um.simpli.fi/aa_px?sk=214760605165006269605 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 169

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=3AAE8C15F97A41BB8B168E31745C5051 HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=3AAE8C15F97A41BB8B168E31745C5051&ckls=true&ci=Wr75vbuWsa&nc=false&trid=287939548

Request Chain 170

https://um.simpli.fi/pubmatic HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3AAE8C15F97A41BB8B168E31745C5051

Request Chain 171

https://um.simpli.fi/freewheel HTTP 302
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=3AAE8C15F97A41BB8B168E31745C5051

Request Chain 172

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=3AAE8C15F97A41BB8B168E31745C5051;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=3AAE8C15F97A41BB8B168E31745C5051;mimetype=img;sr HTTP 302
https://cms.analytics.yahoo.com/cms?partner_id=DATCS HTTP 302
https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS HTTP 302
https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-lXTqpV1E2pT8L6p35u0Otjhe3Z3YIBA8cjE-~A

Request Chain 173

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=3AAE8C15F97A41BB8B168E31745C5051&j=0 HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=3AAE8C15F97A41BB8B168E31745C5051&j=0&xl8blockcheck=1

Request Chain 174

https://um.simpli.fi/yahoo HTTP 302
https://ups.analytics.yahoo.com/ups/55964/sync?uid=3AAE8C15F97A41BB8B168E31745C5051 HTTP 302
https://ups.analytics.yahoo.com/ups/55964/sync?uid=3AAE8C15F97A41BB8B168E31745C5051&verify=true

Request Chain 175

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=3AAE8C15F97A41BB8B168E31745C5051

Request Chain 176

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=3AAE8C15F97A41BB8B168E31745C5051 HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=3AAE8C15F97A41BB8B168E31745C5051

Request Chain 177

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=3AAE8C15F97A41BB8B168E31745C5051 HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=3AAE8C15F97A41BB8B168E31745C5051&dnr=1

Request Chain 178

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=3AAE8C15F97A41BB8B168E31745C5051 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogM0FBRThDMTVGOTdBNDFCQjhCMTY4RTMxNzQ1QzUwNTEQABoNCPHC4L0GEgUI6AcQAEIASgA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=530c995a5792a851bafbeb427c0c22b4b38be8c7024f72f5b960b66208b23541791426b5417dce21&_=2 HTTP 307
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=530c995a5792a851bafbeb427c0c22b4b38be8c7024f72f5b960b66208b23541791426b5417dce21&rand=06205645

Request Chain 179

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1740120432128&cv=7&fst=1740120432128&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1207068312&cv=7&fst=1740120432128&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECCOvMsQIIz86xAg&pscrd=IhMI4ImV4pXUiwMVsQBoCB12GBUNMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=1207068312&cv=7&fst=1740120432128&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECCOvMsQIIz86xAg&pscrd=IhMI4ImV4pXUiwMVsQBoCB12GBUNMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQCjtLzMh1LQ6jkcbxzTrZQQahCfSdvdAGUwfx9s9qKpbV1sC7sJJFgw&random=2240600174

Request Chain 181

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=3AAE8C15F97A41BB8B168E31745C5051

Request Chain 182

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=3AAE8C15F97A41BB8B168E31745C5051&expires=365

Request Chain 183

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=3AAE8C15F97A41BB8B168E31745C5051 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=3AAE8C15F97A41BB8B168E31745C5051

Request Chain 184

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_error=15

Request Chain 200

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&li_adsId=b3f2ac7e-b7a2-4c58-8783-07eb02474b56&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&li_adsId=b3f2ac7e-b7a2-4c58-8783-07eb02474b56&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%252C6313418%26time%3D1740120432714%26li_adsId%3Db3f2ac7e-b7a2-4c58-8783-07eb02474b56%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Ffortisandbox-detects-evolving-snake-keylogger-variant%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&li_adsId=b3f2ac7e-b7a2-4c58-8783-07eb02474b56&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&li_adsId=b3f2ac7e-b7a2-4c58-8783-07eb02474b56&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&cookiesTest=true&liSync=true&e_ipv6=AQJ-xHDTThtU9QAAAZUnQqOBiByaO3drzWGBPQNYRFvP1PZlWUSGt36neqxgTnD9IkqXOg

Request Chain 201

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3182714311601.0938 HTTP 302
https://10104846.fls.doubleclick.net/activityi;dc_pre=CL_uo-KV1IsDFdpkRwEd14IMSA;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3182714311601.0938

Request Chain 210

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=13d54d9e5fb23c2c5d1a303757a2513d_1740120432142 HTTP 303
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=13d54d9e5fb23c2c5d1a303757a2513d_1740120432142&_bee_ppp=1 HTTP 303
https://tracking.contanuity.com/usersync?bwcookie=AADv3E7PcEMAABZyUs5i2Q

Request Chain 227

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=af9c40e0-f01f-11ef-b18c-27d9a85f31e5&gdpr=&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=af9c40e0-f01f-11ef-b18c-27d9a85f31e5&gdpr=&gdpr_consent= HTTP 302
https://px.steelhousemedia.com/tdsync?tdid=038306c5-b09e-44f0-aa43-dec7ea9053d4&shguid=af9c40e0-f01f-11ef-b18c-27d9a85f31e5

Request Chain 228

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=e338613f-52f5-4056-9665-9975a649e7db&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=038306c5-b09e-44f0-aa43-dec7ea9053d4

232 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request fortisandbox-detects-evolving-snake-keylogger-variant Show response
www.fortinet.com/blog/threat-research/ 127 KB
48 KB 537ms
163ms Document
text/html 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

1cd95ff63f0b7859f52855a5b1f3d528b371186a8356e4bcae55b11e402a7a2b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Age: 8755
Cache-Control: max-age=600, public, s-maxage=10800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 48058
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Type: text/html;charset=utf-8
Date: Fri, 21 Feb 2025 05:10:03 GMT
ETag: "1fbe3-62e9f5203c200-gzip"
Last-Modified: Fri, 21 Feb 2025 04:21:10 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: oqhnTCo4xLtnT4bOuwkFiuQAWw4D_HaF_iXBo29-MOddLVq97y6EAg==
X-Amz-Cf-Pop: IAD61-P2
X-Cache: Hit from cloudfront
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher1uswest1-28559594
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK visitorapi.min.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 64 KB
30 KB 506ms
211ms Script
application/javascript 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/visitorapi.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "fe2d-6117284c96900-gzip"
Age: 210224
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: gXpbVRaFlanSHETZcvouZa0KZo7WIBsWMBgY_ihAcgUMYKpp3edS-Q==
Date: Tue, 18 Feb 2025 20:23:22 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 15 Feb 2024 21:43:32 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 29532
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK at.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 104 KB
48 KB 511ms
198ms Script
application/javascript 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "19e83-61431fc4b24c0-gzip"
Age: 311731
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: bPz2iGwO5RMlvuOPhJGMJeSKQtaL2xj6lag9hWIvp-8nD_kIyC4ktg==
Date: Mon, 17 Feb 2025 16:11:35 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 21 Mar 2024 20:59:39 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 fe40bff56d1483fa61dd95ff72f0b9c0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 47782
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.fa8b1a34a064e2d0856091d559d0cb7e.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 547 KB
29 KB 288ms
159ms Stylesheet
text/css 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.fa8b1a34a064e2d0856091d559d0cb7e.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

4ffd3657286299a5561ddebfac6d9c15e3d0154f7a564cf792de1156c9666fae

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "88af5-62d944ad2c280-gzip"
Age: 1154883
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: w8OFZOQphBJpXGhaidiq0pKwUhK_rtg2n7EaK7_9vOC3qbbdaMfFaQ==
Date: Fri, 21 Feb 2025 06:39:08 GMT
Content-Type: text/css;charset=utf-8
Last-Modified: Fri, 07 Feb 2025 21:46:34 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 28722
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 23 KB
8 KB 278ms
98ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

18d9d050df7998e9bf7818ee86fe38893c4641d4e8f077ef6220b6b0ca0a4eaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: f71TQiPGPBWl7F66LKA88g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD50B496D084CF
x-ms-lease-status: unlocked
age: 67286
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 12:05:40 GMT
date: Fri, 21 Feb 2025 06:47:06 GMT
content-type: application/javascript
last-modified: Wed, 19 Feb 2025 07:11:11 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 51335238-c01e-007c-3fd7-820ebf000000
cf-ray: 9154c8770a510faf-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7624
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 408ms
387ms Image
image/svg+xml 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "7ebb-565d53a1d6e40-gzip"
Age: 47324745
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: P_oZ7Q9m_MhxwCJPA8qTCFclaLegjsVLbE383ZdM4CUYQgDU0z80JA==
Date: Fri, 21 Feb 2025 06:47:06 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1998
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
3 KB 718ms
356ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "4fd-60a2031eb4f40"
Age: 40137162
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: JA4sBKiwg7w4s0mJKDlyxQA1k7mZlq5kViHKZ7l6CAcCrM-9VCPhlQ==
Date: Fri, 21 Feb 2025 06:47:06 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d45137f973d454db77c647196f56613a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 160 KB
74 KB 198ms
197ms Script
application/javascript 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.ba4f082a77dabb2c6baf715d9eb61c22.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "28100-61cff12ce1d80-gzip"
Age: 31791
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 40DP0khT2LONS16eyu4PdfYUsxIeLrppku7RRRhYk4BRyHN5nbalYQ==
Date: Thu, 20 Feb 2025 21:57:15 GMT
Content-Type: application/javascript;charset=utf-8
Vary: Accept-Encoding
Last-Modified: Thu, 11 Jul 2024 21:01:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 74768
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 6 KB
2 KB 353ms
143ms XHR
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

21994b28ae9425b76c8a8dec4ad36df0a0f603c9a53db34dc74e59cf9a0639b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: zdgH+rK6XGzrBwTKi8eOeA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DD1BA4717C9D65
age: 35303
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 22 Feb 2025 06:47:06 GMT
date: Fri, 21 Feb 2025 06:47:06 GMT
content-type: application/json
last-modified: Fri, 13 Dec 2024 18:32:04 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: acb53048-701e-0021-698d-4dfebb000000
cf-ray: 9154c8792bd92b53-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1821
x-ms-blob-type: BlockBlob
server: cloudflare

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK bannerDots.svg
www.fortinet.com/content/dam/fortinet/images/icons/pillar/ 41 KB
5 KB 164ms
163ms Image
image/svg+xml 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/icons/pillar/bannerDots.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.fa8b1a34a064e2d0856091d559d0cb7e.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

48db9ee3ec5953cd412bed3604a6820b72a73b9fa63aa5558744470f36d8361f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.fa8b1a34a064e2d0856091d559d0cb7e.css

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "a5e8-60c80c2741a80-gzip"
Age: 376897
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: SlhSwIjPWTb_tpJB_9LAiyvjzYBz1QRLOb2LgZyp6aLXMDHFiZWdvQ==
Date: Sun, 16 Feb 2025 22:05:29 GMT
Content-Type: image/svg+xml
Content-Disposition: attachment; filename="bannerDots.svg"
Vary: Accept-Encoding
Last-Modified: Thu, 14 Dec 2023 23:36:58 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 3483
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK keep-your-account-safe-by-avoiding-dyzap-malware.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 176 KB
178 KB 419ms
418ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/keep-your-account-safe-by-avoiding-dyzap-malware.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

ea813adb4e66ed6ca1abd17238f0198bee303204f37b2fde119e59658e6c9be0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "2c19c-567dc31d40d80"
Age: 46805309
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: hjgJBAgqt8EcwV5L-3zdG72215Vd6nNES-lIePpzTU0cM9arNv5Lvw==
Date: Fri, 21 Feb 2025 06:47:06 GMT
Content-Type: image/png
Last-Modified: Tue, 20 Mar 2018 18:25:10 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 fe40bff56d1483fa61dd95ff72f0b9c0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 180636
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK a-new-all-in-one-botnet-proteus.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 35 KB
37 KB 160ms
159ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/a-new-all-in-one-botnet-proteus.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

50f889884d03bda56ac0292382b170c0d46271fc60abcb33a12d8ac42177cbb1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "8dd7-56746111c6b00"
Age: 233045
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: P2bYuKZUqF8DhI-TFz4E-qz57jG0gRPm0Osv3iv8guhC9-3NsqA_-g==
Date: Tue, 18 Feb 2025 14:12:46 GMT
Content-Type: image/png
Last-Modified: Tue, 13 Mar 2018 07:18:36 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 36311
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK snake-keylogger-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 48 KB
50 KB 232ms
232ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/snake-keylogger-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

60508fca4a54390790c68f6ec949502d38dbf037230c8e5cfa972b134d68a24c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "c1e0-620b31d2d3240"
Age: 14835380
X-Content-Type-Options: nosniff
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: iwemVv9eal7dGgZf7KDciPk6SF7GX2KahlAGqzmgBraZXW5XHyN_kw==
Date: Fri, 21 Feb 2025 06:47:06 GMT
Content-Type: image/png
Last-Modified: Wed, 28 Aug 2024 00:05:21 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 49632
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
38 KB 298ms
157ms Font
application/octet-stream 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.fa8b1a34a064e2d0856091d559d0cb7e.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.fa8b1a34a064e2d0856091d559d0cb7e.css

Response headers

X-Vhost: publish
ETag: "9354-5df4fa74ff980"
Age: 1154552
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Wsfun0GvfljTGB-pC4bez93VGFZcCA74hcpCzS_YaiRiMp6T8nzWvw==
Date: Fri, 07 Feb 2025 22:04:39 GMT
Content-Type: application/octet-stream
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 37716
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 71 B
309 B 298ms
118ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4da8a6638ad70698ad3d01aa0ef124aebe35c297685c0796b174822f597b1d09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 9154c87b2e90101d-LAX
access-control-allow-origin: *
date: Fri, 21 Feb 2025 06:47:06 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK fortisandbox-blog-autoit-volumehits.png
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1739925568051/ 45 KB
47 KB 172ms
172ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1739925568051/fortisandbox-blog-autoit-volumehits.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

00faf2672d1c7fe5dd776ce57d1419d865fa5e057a3ec339c4cf6fbdd16a89f8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "b535-62e73fd6a9000"
Age: 193771
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 7pjSK7K_Sf2L061w2n249moLnIupSBl0OpbzSXskaNINkJ3j9GcV2Q==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/png
Last-Modified: Wed, 19 Feb 2025 00:39:28 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 753abf75c4fb02577e3748ad81a5ead0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 46389
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig02-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_936958755.img.jpeg/1739514956920/ 19 KB
20 KB 171ms
171ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_936958755.img.jpeg/1739514956920/fig02-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

29fb3e46f5797eb7705973e16d533228a814c942e5a87d1b577ab50ac9b05341

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "4b3c-62e146308ab00"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Cbce1mTsL0dc3wri9SGPbvyhj7Qqfah4RoqauEP7qAjzAtwNdeS8Uw==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:35:56 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 19260
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig03-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1814506802.img.jpeg/1739515034228/ 144 KB
145 KB 160ms
160ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1814506802.img.jpeg/1739515034228/fig03-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8446bedaded69d8ebd347bf1653a1bacfc07325d08c89a09f253af9df95175fe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "23e1e-62e1467aeda80"
Age: 193827
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zkR_0Glry65m34Kvq6IcViCvp1iZq-hJ-kp0Sd2pJEG99zzzrE7m4Q==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:37:14 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 d45137f973d454db77c647196f56613a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 146974
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig04-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_2101814459.img.jpeg/1739515396176/ 25 KB
26 KB 162ms
161ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_2101814459.img.jpeg/1739515396176/fig04-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

9f72a396c065f740bdbd9b194c9533caf1c670c733bb111053e745c6c7b91b97

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "6201-62e147d428900"
Age: 194847
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: fNEWAYnlvISSGP9CxBebr-m3Imx_Ni9EWX-V9CFVb3Sn2WALF0Qaqw==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:43:16 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 25089
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig05-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_404017904.img.jpeg/1739515468833/ 124 KB
125 KB 161ms
161ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_404017904.img.jpeg/1739515468833/fig05-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b2103a4f9f9282f68c2e6e5a56c449f2922be99270fa9910d19098b93afe2d26

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "1ee7d-62e14818d2b00"
Age: 193828
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 6Y5Qsr6QN8UqT68haHZk-NqxqlCGZDYF2BlLm6g54Axg-k4HsWM0vQ==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:44:28 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 126589
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig06-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1039437413.img.jpeg/1739515515194/ 26 KB
28 KB 160ms
160ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1039437413.img.jpeg/1739515515194/fig06-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a41d192fd18c2f7cdbd088af95a56af9dee5b261ac9be6210bd0f922d19ec5ba

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "68fe-62e14845a54c0"
Age: 194847
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ONYpxmMc9I_Tvgfhc-hhSiwHZsmB_eHTnLzQWze0HWzW3rPB3SUV1g==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:45:15 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 753abf75c4fb02577e3748ad81a5ead0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 26878
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig07-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_306152618.img.jpeg/1739515562387/ 12 KB
13 KB 161ms
161ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_306152618.img.jpeg/1739515562387/fig07-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b8ea1ecff9e21aef9388ba3961835b44ecd42defa908bb63658ba1cd5634f7da

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "2f03-62e1487277e80"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: qXinEvlVShWcqV1ChAA2QUcTBd9CoYYu1OREHs5gsOcJBd_bjPxYeQ==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:46:02 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 12035
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig08-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_447237101.img.jpeg/1739515613065/ 49 KB
50 KB 160ms
159ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_447237101.img.jpeg/1739515613065/fig08-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0e79e0cf390976782043cdd0e4fb66661c9f7d61652a98524e3daeb57bfd8e7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "c3dc-62e148a31b140"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: dry_mHkDWTly8js0SCnGET_wr0P5CD9UG0jUO4hNyuN9S0Ml4M83tg==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:46:53 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 fe40bff56d1483fa61dd95ff72f0b9c0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 50140
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig09-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_529918456.img.jpeg/1739515662566/ 33 KB
35 KB 161ms
160ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_529918456.img.jpeg/1739515662566/fig09-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

15fad644065e1a49aa9afade708793103edcb1223e9bf5b6456f7cfe8b0e50a6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "85e6-62e148d1d5f80"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: rwAsHElECocmG578HWEwMfSGbZvB4BL_Mkcm8LUY7ZPe1NWge6Uhmg==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:47:42 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 753abf75c4fb02577e3748ad81a5ead0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 34278
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig10-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1785132483.img.jpeg/1739515746910/ 18 KB
19 KB 159ms
159ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1785132483.img.jpeg/1739515746910/fig10-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

59b3bd516133fe0205b749b48d7472907a885938f7f46e08450349cd2ff808c6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "4822-62e14921f1c80"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: OoXahb9nWbtFhKi3UDmCpxmGbeQC7E5NxPTGinC0agQtheyD7j-LKg==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:49:06 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d45137f973d454db77c647196f56613a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 18466
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig11-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_411259125.img.jpeg/1739515825609/ 167 KB
169 KB 158ms
157ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_411259125.img.jpeg/1739515825609/fig11-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a88c22cdf0f3c7434c98426d5b493aa7cf3f6d3757e350d13a440ec6d7982185

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "29cdf-62e1496d48e40"
Age: 193698
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: WnV1WpUUNNK-VtbSbsoy3Suf7BO7s0CCd3PsclTRkMUcEoP6MNubcA==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:50:25 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 171231
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig12-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_103943210.img.jpeg/1739515882975/ 60 KB
61 KB 160ms
159ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_103943210.img.jpeg/1739515882975/fig12-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

e1fdc57bdb7295c9178d55076cd31466a661113cd89febcf10a2baa0e0dd5f27

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "ef0d-62e149a3a4e80"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ZP7nMqYhamwQPP5BIkLBKNrL_OnqJgHob6149kxVV-BUy3i56ijxuA==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:51:22 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 fe40bff56d1483fa61dd95ff72f0b9c0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 61197
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig13-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1083473347.img.jpeg/1739515939169/ 80 KB
81 KB 162ms
161ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1083473347.img.jpeg/1739515939169/fig13-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

e0488b186e4c346fa8984b89d4967f1ec74b1c5e4b08e001b0da1d54fcde0d57

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "1404f-62e149da00ec0"
Age: 194845
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 00BVS8MAFFpB1n4GQX8bLLdM5Hl1snRPv5xthrRWxjm9MSWM41PuCg==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:52:19 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 81999
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig14-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_2066966967.img.jpeg/1739515979526/ 49 KB
51 KB 161ms
161ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_2066966967.img.jpeg/1739515979526/fig14-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

6d99c0d5a4651725b742a9c6d661473c568f48179c805c7fb5c13b2f4ce99653

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "c4f9-62e14a00268c0"
Age: 194845
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: iikzR-iDPV-etyK6fKDE42opODyAesUhW7LA4gREd9Zzp3KhktH_fQ==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:52:59 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 753abf75c4fb02577e3748ad81a5ead0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 50425
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig15-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_608930024.img.jpeg/1739516069923/ 58 KB
59 KB 159ms
159ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_608930024.img.jpeg/1739516069923/fig15-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

26814e51f388a7fda526270be49fefb245a520cd056c10191cdca19da9b379bc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "e707-62e14a55fb340"
Age: 194845
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zVJiLw8AY-Gotaevv6Uboeh6KdD1QglgCxgXvmFVV7V4vNB4ZjiTGw==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:54:29 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Connection: keep-alive
Via: 1.1 d45137f973d454db77c647196f56613a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 59143
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202312.1.0/ 428 KB
104 KB 102ms
102ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202312.1.0/otBannerSdk.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df54c069da584ec929d42161c8fd19e74c7f408d70e6e7e0f8d27cc9c02a0ad9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: omr+ywUvfLiKRTWN9kGq4A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5D5D2845E0F
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 67256
x-content-type-options: nosniff
date: Fri, 21 Feb 2025 06:47:06 GMT
content-type: application/javascript
last-modified: Tue, 16 Jul 2024 20:28:15 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f13381c2-801e-00b7-0cb7-629c8f000000
cf-ray: 9154c87c49ca0faf-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 106367
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/0193b7e6-ad55-703c-9172-9475d955a432/ 167 KB
30 KB 120ms
119ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/0193b7e6-ad55-703c-9172-9475d955a432/en.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19aa1e382d440aef426bfd7685c967a0e9d027e85593815e2e156381e0d569c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: I24n72+EdWIPsgFo5zWZtw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DD1BA4731CE29A
age: 9120
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 22 Feb 2025 06:47:07 GMT
date: Fri, 21 Feb 2025 06:47:07 GMT
content-type: application/json
last-modified: Fri, 13 Dec 2024 18:32:07 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: ec62a317-e01e-0060-398d-4dd6a8000000
cf-ray: 9154c87d8ac02b53-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30339
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202312.1.0/assets/ 13 KB
3 KB 101ms
100ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202312.1.0/assets/otFlat.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: ARQEKEIm6vQ/N3KyvZ+N6w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5D5CD8448A5
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 62771
x-content-type-options: nosniff
date: Fri, 21 Feb 2025 06:47:07 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 20:28:07 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 2cfd7bcf-e01e-00ac-798d-4db21d000000
cf-ray: 9154c87e6bc72b53-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3017
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/202312.1.0/assets/v2/ 63 KB
14 KB 100ms
99ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202312.1.0/assets/v2/otPcTab.json

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2bc6a125d698416498cdf5ef60cd959aef01db95a6e3e0d74a95f9b6d3d78feb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: d/OMDt25lBl+23GhDCHwSg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5D5CF00B170
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 55533
x-content-type-options: nosniff
date: Fri, 21 Feb 2025 06:47:07 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 20:28:09 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ea7be340-801e-003f-4160-572456000000
cf-ray: 9154c87e6bca2b53-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13588
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202312.1.0/assets/ 21 KB
4 KB 99ms
98ms Fetch
text/css 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202312.1.0/assets/otCommonStyles.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: c7xAZ9MSGAobGaTYg/Qtag==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 62771
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 21 Feb 2025 06:47:07 GMT
content-type: text/css
last-modified: Tue, 16 Jul 2024 20:28:20 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 2b3253c6-601e-00f2-608d-4d411e000000
cf-ray: 9154c87e6bcd2b53-LAX
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
625 B 95ms
95ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 75045
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 21 Feb 2025 06:47:07 GMT
content-type: image/svg+xml
last-modified: Wed, 19 Feb 2025 07:11:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f965a8d4-901e-006f-3c50-833b5e000000
cf-ray: 9154c87f2e020faf-LAX
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
495 B 100ms
100ms Fetch
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 53826
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 21 Feb 2025 06:47:07 GMT
content-type: image/svg+xml
last-modified: Wed, 19 Feb 2025 07:11:12 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 210f1b6f-f01e-00b3-7634-83690d000000
cf-ray: 9154c87f3cc82b53-LAX
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 510 KB
124 KB 501ms
157ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

b7ed027ef1dada70383fb3537e124725d2091fadc7d7ef07cbb3a0960fd24d2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "839d07ce4a90c70d254ade8f138f132f:1740001673.863381"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:07 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 126142
date: Fri, 21 Feb 2025 06:47:07 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:54 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 ftnt_logo.png
cdn.cookielaw.org/logos/40ea360a-b28c-4701-978f-f497ebbef386/8f15a333-e829-4652-85c8-1bcbed52f0ab/9c802c60-54df-494f-a9dc-b58b77bfe9c0/ 2 KB
2 KB 95ms
94ms Image
image/png 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/40ea360a-b28c-4701-978f-f497ebbef386/8f15a333-e829-4652-85c8-1bcbed52f0ab/9c802c60-54df-494f-a9dc-b58b77bfe9c0/ftnt_logo.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b0a6a5f0ee45c837fcd1a12a51effd4d94cacc135ce756d51a5709d9ca6ec78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: nqrv9bIB1vDFQ7wAsIm2RA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8D8A2C002351218
age: 55450
cf-cache-status: HIT
x-content-type-options: nosniff
date: Fri, 21 Feb 2025 06:47:07 GMT
content-type: image/png
last-modified: Thu, 17 Dec 2020 19:14:42 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: eaf69bb8-801e-0088-4873-79dc8a000000
cf-ray: 9154c87f5e410faf-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2306
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 94ms
93ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 41880
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 21 Feb 2025 06:47:07 GMT
content-type: image/svg+xml
last-modified: Wed, 19 Feb 2025 07:11:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 645b5bd1-101e-0018-3401-83be1f000000
cf-ray: 9154c87f5e460faf-LAX
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 id Show response
dpm.demdex.net/ 367 B
917 B 492ms
159ms XHR
application/json 44.208.97.160
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1740120427377

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.208.97.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-208-97-160.compute-1.amazonaws.com

Software

Resource Hash

5cfc692b4a80789116136fc18a20797f18ca8c5af104eba055490e52ff49e0f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v071-0d1024ba3.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: IVxhXNCqQxo=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.fortinet.com
content-length: 312
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 21 Feb 2025 06:47:07 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 dest5.html
fortinet.demdex.net/ Frame 90C5 0
0 506ms
159ms Document
text/html 3.95.113.145
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.95.113.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-113-145.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 21 Feb 2025 06:47:08 GMT
dcs: dcs-prod-va6-2-v071-0eb5ddca2.edge-va6.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Mon, 3 Feb 2025 07:59:02 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: 0h4nrPP0Ryw=

GET
H2

200

ibs:dpid=411&dpuuid=Z7ghbAAAAIYwtgM0
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=18216757739523472551750050414122619760
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Z7ghbAAAAIYwtgM0

42 B
714 B

160ms
159ms

Image
image/gif

44.208.97.160
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Z7ghbAAAAIYwtgM0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Server

44.208.97.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-208-97-160.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v071-0e318257d.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: psog17MDRSg=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 21 Feb 2025 06:47:08 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Z7ghbAAAAIYwtgM0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Fri, 21 Feb 2025 06:47:08 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

POST
H2 200 delivery Show response
fortinet.tt.omtrdc.net/rest/v1/ 3 KB
1 KB 525ms
175ms XHR
application/json 63.140.38.189
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://fortinet.tt.omtrdc.net/rest/v1/delivery?client=fortinet&sessionId=c3e955b587de4bc6929c2552f7a85bcf&version=2.10.0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.189 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-189.data.adobedc.net

Software

jag /

Resource Hash

82e794cc9f94fc996f16011f455a25e63136aec4d959eda35fce76b6fcf209ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 884f5ed1-40be-4321-a357-2e42a4d8e340
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://www.fortinet.com
date: Fri, 21 Feb 2025 06:47:08 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/ 35 KB
13 KB 159ms
159ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/AppMeasurement.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

7db8d077fc21c20f1449a2603d524e423cfa25d7df6d5fd845a8e5e883aa227e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "66aabcd8a7ba429711eebdad8acc3dd6:1729811534.672229"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 13011
date: Fri, 21 Feb 2025 06:47:08 GMT
content-type: application/x-javascript
last-modified: Thu, 24 Oct 2024 23:12:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/ 3 KB
2 KB 174ms
173ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/AppMeasurement_Module_ActivityMap.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

2a250e2f225e48cf583d54a0a42d623c700847de17323bf23ea372e5d9e89cb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "ddda3fb3f27121fcba6a33a82f32d57c:1729811534.987187"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1598
date: Fri, 21 Feb 2025 06:47:08 GMT
content-type: application/x-javascript
last-modified: Thu, 24 Oct 2024 23:12:14 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 highlight.js Show response
cdn.schemaapp.com/javascript/ 38 KB
12 KB 539ms
172ms Script
application/javascript 2600:9000:23cb:3400:a:6e64:b280:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://cdn.schemaapp.com/javascript/highlight.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:23cb:3400:a:6e64:b280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

8c7763d7ca20026303e95458b1c4f9c7bfddb2fb6765cf058df50109fa0553ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
x-amz-meta-version: 1.75.1
x-amz-version-id: KkYRk3mVez95xTIn6sj8e6foF8IWJr4o
etag: W/"af7dc54456da8a29cdebdd5960bea9b2"
age: 79324
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: dolVqmP5PDETBC4zuefPCCDHU_mn99kNZ8EgJQoQgiI3MiqEehedHA==
date: Thu, 20 Feb 2025 08:45:05 GMT
content-type: application/javascript
vary: accept-encoding, Origin
last-modified: Fri, 14 Feb 2025 22:24:17 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-replication-status: COMPLETED
referrer-policy: strict-origin-when-cross-origin
via: 1.1 11addd18912b8ffba16fde7055a9ca56.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block
x-amz-cf-pop: JFK50-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 372ms
111ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

9398c7190476b7b930d63f828ff450861f10b85dac2b21dc20d7ed8133490d04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "8063974e2c78db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9FBD478659DA48D3BC5C7280B121922E Ref B: LAX311000113049 Ref C: 2025-02-21T06:47:08Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14614
date: Fri, 21 Feb 2025 06:47:08 GMT
content-type: application/javascript
last-modified: Thu, 06 Feb 2025 00:16:03 GMT
vary: Accept-Encoding

GET
H2 200 RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 9 KB
2 KB 159ms
158ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC41e16e9b16d1408cbf43b5b2e7378738-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

8a778662df7a850ea1cd82287736d893311caeb3cb7652fb33e4b2c6f5a160ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 1845
date: Fri, 21 Feb 2025 06:47:08 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 358 B
508 B 161ms
160ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

ac6aec96f603d832d19c5d20bf3ddf80be707441e0457bed6507af1b80bb6e28

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 228
date: Fri, 21 Feb 2025 06:47:08 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 703 B
707 B 161ms
161ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RCa4add8b607f6404fbd2aba7ee4b9abad-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

1960b031e24a73247b618959d145beb94ee0e9b52d6f0165fc852ff223f7ac9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 426
date: Fri, 21 Feb 2025 06:47:08 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 428 KB
138 KB 498ms
179ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JH142QCQCJ&l=dataLayer

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

66a04863f707aa396e0cc70d0b8aaca97f1051642c17fdbcfaf0148ef9dd046c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
expires: Fri, 21 Feb 2025 06:47:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 21 Feb 2025 06:47:08 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
content-length: 140251
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 RC0f37d244d9ce4f30a5cae18379878eaa-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 635 B
665 B 160ms
160ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC0f37d244d9ce4f30a5cae18379878eaa-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

a2178f28d4a30172146fcc241322eb2b2fa8b7304edc707ff49d67dfcf81db26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 384
date: Fri, 21 Feb 2025 06:47:08 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 17532650.js Show response
bat.bing.com/p/action/ 364 B
412 B 113ms
113ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL

https://bat.bing.com/p/action/17532650.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

cce2184ec089babc70ded47b8474c543f6a5ff013e4bfd9dbae8689489bb13ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 39D34622CB4548FB8DDC34B2AC75F390 Ref B: LAX311000113049 Ref C: 2025-02-21T06:47:08Z
x-cache: CONFIG_NOCACHE
date: Fri, 21 Feb 2025 06:47:08 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 204 0
bat.bing.com/action/ 0
361 B 113ms
113ms Image
text/plain 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17532650&tm=al001&Ver=2&mid=447a2254-c8fb-486d-95c5-34249bc95984&bo=1&sid=abcc2a70f01f11efb5be7df3ef036df3&vid=abcc4db0f01f11efbd73097a7fdbe845&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&kw=FortiGuard%20Labs%20Threat%20Research,FortiGuard%20Labs%20Threat%20Research,keylogger&p=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&r=&lt=1563&pt=1740120425157,,,,,0,1,58,58,375,213,376,537,839,544,1556,1556,1563,,,&pn=0,0&evt=pageLoad&sv=1&cdb=AQET&rn=994863

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 767A7E8E08604E87A4E531140FE45A84 Ref B: LAX311000113049 Ref C: 2025-02-21T06:47:08Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 21 Feb 2025 06:47:08 GMT

OPTIONS
H2 200 aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tL2Jsb2cvdGhyZWF0LXJlc2VhcmNoL2ZvcnRpc2FuZGJveC1kZXRlY3RzLWV2b2x2aW5nLXNuYWtlLWtleWxvZ2dlci12YXJpYW50
data.schemaapp.com/Fortinet/ Frame 0
0 569ms
208ms Preflight 2600:9000:21da:fc00:1f:d9e6:d540:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://data.schemaapp.com/Fortinet/aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tL2Jsb2cvdGhyZWF0LXJlc2VhcmNoL2ZvcnRpc2FuZGJveC1kZXRlY3RzLWV2b2x2aW5nLXNuYWtlLWtleWxvZ2dlci12YXJpYW50

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21da:fc00:1f:d9e6:d540:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Accept: */*
Access-Control-Request-Headers: x-account-id
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: x-account-id
access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-source
access-control-max-age: 3000
content-length: 0
date: Fri, 21 Feb 2025 06:47:10 GMT
server: AmazonS3
strict-transport-security: max-age=31536000; includeSubDomains;
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
via: 1.1 3425db2c749d144a96b60e99c2493db0.cloudfront.net (CloudFront)
x-amz-cf-id: ddKTetjf00oHOsyDYLRtYSA_CVGJ5OtMi0xVfyqtxrNMGWvCyx62hA==
x-amz-cf-pop: EWR53-C1
x-cache: Miss from cloudfront

OPTIONS
H2 200 aHR0cHM6Ly93d3cuZm9ydGluZXQuY29t
cdn.schemaapp.com/highlighter/prod/Fortinet/v2/ Frame 0
0 501ms
185ms Preflight 2600:9000:23cb:3400:a:6e64:b280:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://cdn.schemaapp.com/highlighter/prod/Fortinet/v2/aHR0cHM6Ly93d3cuZm9ydGluZXQuY29t

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:23cb:3400:a:6e64:b280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: x-account-id
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 14400
content-length: 0
date: Fri, 21 Feb 2025 06:47:10 GMT
referrer-policy: strict-origin-when-cross-origin
server: AmazonS3
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method Access-Control-Request-Method Access-Control-Request-Headers
via: 1.1 500a5a4e72d986068e53ce22c8372bde.cloudfront.net (CloudFront)
x-amz-cf-id: SPGcCSS_Vsl1eUWbDjdFf3Z9E2gVp8_3HcfTY0ZMrS-mm22XkkT4sQ==
x-amz-cf-pop: JFK50-P1
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tL2Jsb2cvdGhyZWF0LXJlc2VhcmNoL2ZvcnRpc2FuZGJveC1kZXRlY3RzLWV2b2x2aW5nLXNuYWtlLWtleWxvZ2dlci12YXJpYW50 Show response
data.schemaapp.com/Fortinet/ 0
454 B 221ms
220ms Fetch
application/json 2600:9000:21da:fc00:1f:d9e6:d540:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://data.schemaapp.com/Fortinet/aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tL2Jsb2cvdGhyZWF0LXJlc2VhcmNoL2ZvcnRpc2FuZGJveC1kZXRlY3RzLWV2b2x2aW5nLXNuYWtlLWtleWxvZ2dlci12YXJpYW50

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21da:fc00:1f:d9e6:d540:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

x-account-id: Fortinet
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
accept: application/json

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
access-control-max-age: 3000
access-control-expose-headers: x-amz-meta-source
cache-control: max-age=14400
access-control-allow-methods: GET, HEAD
via: 1.1 3425db2c749d144a96b60e99c2493db0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: Fjl3ZH9iWe6NlXkESreGI8AfkRURuWALmRNlgGZLox1skuNooazK1Q==
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/json
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
server: AmazonS3
x-amz-cf-pop: EWR53-C1

GET
H2 200 aHR0cHM6Ly93d3cuZm9ydGluZXQuY29t Show response
cdn.schemaapp.com/highlighter/prod/Fortinet/v2/ 22 KB
4 KB 167ms
165ms Fetch
application/json 2600:9000:23cb:3400:a:6e64:b280:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://cdn.schemaapp.com/highlighter/prod/Fortinet/v2/aHR0cHM6Ly93d3cuZm9ydGluZXQuY29t

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:23cb:3400:a:6e64:b280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

99ae400fd871a6829ad0549d8f80ac7c3f0c7efd039856f2b97edea300f1c07c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

x-account-id: Fortinet
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
accept: application/json

Response headers

x-amz-meta-url: https://www.fortinet.com
access-control-expose-headers: x-amz-meta-source,x-amz-meta-accountid,x-amz-meta-url
content-encoding: br
x-amz-version-id: vkWSgCfTI0We1pidERaNzE27AkmF.Qx5
etag: W/"888e27e950b5ed02a8553b58da3e4d14"
age: 207077
x-content-type-options: nosniff
x-amz-meta-source: SchemaApp
x-amz-meta-templateid
x-cache: Hit from cloudfront
x-amz-cf-id: XvSO-Ufi74eSWllC9UXxj3wafA2RNO4eyD9FgKwohBiXFqcyGq5Q3w==
date: Tue, 18 Feb 2025 21:15:53 GMT
content-type: application/json
vary: accept-encoding
last-modified: Tue, 18 Feb 2025 21:14:50 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-replication-status: COMPLETED
cache-control: max-age=699840
referrer-policy: strict-origin-when-cross-origin
via: 1.1 500a5a4e72d986068e53ce22c8372bde.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 1; mode=block
x-amz-meta-companyid: http://schemaapp.com/resources/Company/Fortinet
x-amz-cf-pop: JFK50-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 0786.js Show response
script.crazyegg.com/pages/scripts/0117/ 7 KB
3 KB 230ms
111ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16fb72ffe51980a00e52edf9a001b7d560b2bdbd1a56e04366a70b674204c359

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 57528
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: text/javascript
last-modified: Thu, 20 Feb 2025 14:48:02 GMT
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 9154c889cb667ac4-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2481
ce-version: 11.5.352
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 501ms
165ms Script
application/javascript 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

08a45557e96f2f1d5584a6287baaad19ddb6ccd9c807f6e88ba8a3bc55b8bbbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "67b73244-111a4"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 09:47:09 GMT
accept-ranges: bytes
content-length: 18949
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/javascript
last-modified: Thu, 20 Feb 2025 13:46:44 GMT
vary: Accept-Encoding

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 27 KB
9 KB 490ms
163ms Script
application/x-javascript 23.41.169.82
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.82 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-82.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f4810c749b515a37bd4e8639dd9d7d1289dd21aaf990774e0a1e31a8e4911158

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Content-Encoding: gzip
ETag: "1f7f7030280a4f7e52250fcede626547:1740042960.228632"
Connection: keep-alive
Expires: Fri, 21 Feb 2025 07:07:09 GMT
Accept-Ranges: bytes
X-CC: US
Content-Length: 9106
X-RG: NA
Date: Fri, 21 Feb 2025 06:47:09 GMT
Content-Type: application/x-javascript
Last-Modified: Thu, 20 Feb 2025 09:11:05 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 25f2dd15-02c6-4e7a-bc8b-c5722b49624d Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 468ms
153ms Script
application/javascript 34.86.110.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tag.simpli.fi/sifitag/25f2dd15-02c6-4e7a-bc8b-c5722b49624d
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.86.110.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.110.86.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-request-id: GCYmT5cU7yEBnUMt6eqC
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/site/ Frame 9ED9 4 KB
2 KB 208ms
116ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/site/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0117/0786.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64c149abf4d0b26539446abeb0ba4c5e8180ca0f55b812f8b822812a23e0cb29

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 57527
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/json
last-modified: Thu, 20 Feb 2025 14:48:02 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 9154c88b2ccbed38-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1363
ce-version: 11.5.352
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 293 KB
102 KB 176ms
174ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c&gtm=45je52k0v893708426za200

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ae2d41b50d412a6c82e2046834f185d5e189d7d870f1440283dceccc8f88f5cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
expires: Fri, 21 Feb 2025 06:47:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 21 Feb 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
content-length: 103889
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 258 KB
92 KB 392ms
391ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c&gtm=45je52k0v893708426za200

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a2d72803f86e55b4de83d3f30f408f05897f29787f5a9cce5994402b74790b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
expires: Fri, 21 Feb 2025 06:47:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 21 Feb 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
content-length: 93610
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 265 KB
94 KB 391ms
390ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c&gtm=45je52k0v893708426za200

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

941ced91edfdd239bfc8a27902822a1ef74592f4b975701656f1792e3fdb192a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
expires: Fri, 21 Feb 2025 06:47:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 21 Feb 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
content-length: 96517
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 279 KB
98 KB 385ms
384ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-729495989&l=dataLayer&cx=c&gtm=45je52k0v893708426za200

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6ba6d1b450a99dde0fa8110122c9202d4661d922f2a3e82a757333e2fa71c185

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
expires: Fri, 21 Feb 2025 06:47:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 21 Feb 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
content-length: 99996
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 442 KB
140 KB 600ms
599ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-748285774&l=dataLayer&cx=c&gtm=45je52k0v893708426za200

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

483bd926e0154420ffcb610d6461cabaeefe68c613fe7819b748474f1f5646a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
expires: Fri, 21 Feb 2025 06:47:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
content-length: 143032
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 c7deac18f0e7b90e6cef3f0fe19c780a.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 110 KB
37 KB 111ms
111ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/c7deac18f0e7b90e6cef3f0fe19c780a.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2405c03999cdb1fda1c029c6b392718eac0e044dad46ec29a743941f20c63942

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
age: 57549
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: text/javascript
last-modified: Fri, 14 Feb 2025 16:21:42 GMT
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
cf-ray: 9154c88bdd567ac4-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 38120
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 351 KB
116 KB 615ms
615ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-38BQ9XFDT4

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9ceceb1fbc22685946d85befd074085b6b4fded0f6ac2ad22912e2cce0152439

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1003:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1003:0"}],}
expires: Fri, 21 Feb 2025 06:47:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1003:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1003:0
content-length: 118862
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK 00ad3119690e692fd6990245f9741ea8f1 Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
539 B 511ms
164ms Script
text/html 23.41.169.82
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.41.169.82 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-41-169-82.deploy.static.akamaitechnologies.com

Software

/ Express

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Content-Encoding: gzip
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Expires: Fri, 21 Feb 2025 06:48:09 GMT
X-CC: US
Date: Fri, 21 Feb 2025 06:47:09 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
x-traceid: 715f28f265de52ab98aabccf804c643a
strict-transport-security: max-age=31536000; includeSubDomains; preload
Cache-Control: max-age=60
ob-sent-time: 1740053599323
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Length: 22
X-RG: NA
x-powered-by: Express

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 496ms
158ms Fetch
text/html 23.41.169.82
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.82 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-82.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: max-age=1200
Connection: keep-alive
Observe-Browsing-Topics: ?1
Expires: Fri, 21 Feb 2025 07:07:09 GMT
Access-Control-Allow-Origin: *
X-CC: US
Content-Length: 26
X-RG: NA
Date: Fri, 21 Feb 2025 06:47:09 GMT
Content-Type: text/html

GET
H/1.1 200
OK unifiedPixel Show response
tr.outbrain.com/ 53 B
321 B 465ms
143ms Fetch
image/gif 64.202.112.31
SERVERCENTRAL

General

Check archive.org

Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?au=false&bust=07594962373165035&referrer=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&marketerId=00ad3119690e692fd6990245f9741ea8f1&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&g=0&zone=all&obApiVersion=1.1&obtpVersion=2.18.168

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

64.202.112.31 , United States, ASN23352 (SERVERCENTRAL, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 54
content-encoding: br
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: image/gif;
x-traceid: 7467aa19799d423c4548c3b0fc0b8fa0

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 483ms
152ms Script
application/javascript 64.202.112.31
SERVERCENTRAL

General

Check archive.org

Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=00ad3119690e692fd6990245f9741ea8f1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

64.202.112.31 , United States, ASN23352 (SERVERCENTRAL, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 39
content-encoding: br
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: application/javascript
x-traceid: 12b9b5e11819c6e93eda4ac83377a0d6

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 185ms
158ms XHR
text/html 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-34-59-33.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.fortinet.com
content-length: 7
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 18 B
309 B 508ms
159ms XHR
text/html 2600:141b:f000:36::1728:129e
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:f000:36::1728:129e Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 1fdddb377d6442ed4a9ea71787b84b868c358163da4c5ecbdc55a65ea280a713

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2a04:c604:615:1::6
expires: Fri, 21 Feb 2025 06:47:10 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1740120429842_388501920_213115270_26_1015_164_169_219";dur=1
access-control-allow-origin: https://www.fortinet.com
content-length: 18
date: Fri, 21 Feb 2025 06:47:10 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
245 B 194ms
170ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A09%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&v=1.1.32

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:09 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
244 B 191ms
166ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2021%20Feb%202025%2006%3A47%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%225eeecf22b2d12a77a14639dce97b7a36%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2021%20Feb%202025%2006%3A47%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2021%20Feb%202025%2006%3A47%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2021%20Feb%202025%2006%3A47%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227381d1d7c753fe2d8e217c3fdc44c0f17418dcc4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2021%20Feb%202025%2006%3A47%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&v=1.1.32

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:09 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:09 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx

OPTIONS
H2 200 aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLyNDb3Jwb3JhdGlvbg
data.schemaapp.com/Fortinet/ Frame 0
0 166ms
166ms Preflight 2600:9000:21da:fc00:1f:d9e6:d540:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://data.schemaapp.com/Fortinet/aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLyNDb3Jwb3JhdGlvbg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21da:fc00:1f:d9e6:d540:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Accept: */*
Access-Control-Request-Headers: x-account-id
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: x-account-id
access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-source
access-control-max-age: 3000
age: 3182
content-length: 0
date: Fri, 21 Feb 2025 05:54:08 GMT
server: AmazonS3
strict-transport-security: max-age=31536000; includeSubDomains;
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
via: 1.1 3425db2c749d144a96b60e99c2493db0.cloudfront.net (CloudFront)
x-amz-cf-id: adRJcq8BZvaM7HimbWPAF9PDwGMAgoG5cZfwqQMoopmAJEpo6z_QZQ==
x-amz-cf-pop: EWR53-C1
x-cache: Hit from cloudfront

OPTIONS
H2 200 entities
api.schemaapp.com/markup/ Frame 0
0 519ms
169ms Preflight
application/json 3.220.146.83
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://api.schemaapp.com/markup/entities?highlight_id=http%3A%2F%2Fschemaapp.com%2Fresources%2FTagLookupOmniLinkedEntity_6760f8d1501e20.85355480&highlight_config=%7B%22%40id%22%3A%22http%3A%2F%2Fschemaapp.com%2Fresources%2FTagLookupOmniLinkedEntity_6760f8d1501e20.85355480%22%2C%22xPath-input%22%3A%22%2Fhtml%2Fbody%2Fdiv%5B1%5D%2Fdiv%2Fdiv%5B2%5D%2Fdiv%2Fdiv%22%2C%22propertyPath%22%3A%5B%22mentions%22%5D%2C%22%40type%22%3A%22TagLookupOmniLinkedEntity%22%7D&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.220.146.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-146-83.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-account-id
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Requested-With,X-Hash,cache-control,x-account-id
access-control-allow-methods: POST,DELETE,OPTIONS,HEAD
access-control-allow-origin: *
content-length: 3
content-type: application/json
date: Fri, 21 Feb 2025 06:47:10 GMT
x-amz-apigw-id: GUopQEcNoAMEvOA=
x-amzn-requestid: 9ec9b92b-9d90-4e7f-b3d8-d47b29249196
x-amzn-trace-id: Root=1-67b8216e-0c63a9717485355f799d0247

GET
H2 200 aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLyNDb3Jwb3JhdGlvbg Show response
data.schemaapp.com/Fortinet/ 2 KB
2 KB 163ms
163ms Fetch
application/json 2600:9000:21da:fc00:1f:d9e6:d540:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://data.schemaapp.com/Fortinet/aHR0cHM6Ly93d3cuZm9ydGluZXQuY29tLyNDb3Jwb3JhdGlvbg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21da:fc00:1f:d9e6:d540:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

6ab8cec21d24650e7daff4c1b478cd643158968caec50be8f44571eed95d130b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

x-account-id: Fortinet
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
accept: application/json

Response headers

x-amz-meta-url: https://www.fortinet.com/#Corporation
access-control-max-age: 3000
access-control-expose-headers: x-amz-meta-source
content-encoding: gzip
x-amz-version-id: JL3XPQMGaH3aLjFwp_X3XsnEx3RSDrKq
etag: W/"888a68fe35afddc64f3c7bb5822fef2b"
age: 83749
access-control-allow-methods: GET, HEAD
x-amz-meta-source: Editor
x-cache: Hit from cloudfront
x-amz-cf-id: dMFMFSLILtvZmNpNcLawBpwozDWPyySPe2KBWSkf3ZloWeQuEl7K4A==
date: Thu, 20 Feb 2025 07:43:48 GMT
x-amz-meta-accountid: Fortinet
content-type: application/json
last-modified: Fri, 13 Dec 2024 16:13:08 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
strict-transport-security: max-age=31536000; includeSubDomains;
x-amz-replication-status: COMPLETED
cache-control: max-age=699840
x-amz-meta-mainaccount: Fortinet
via: 1.1 3425db2c749d144a96b60e99c2493db0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: EWR53-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 entities Show response
api.schemaapp.com/markup/ 7 KB
7 KB 386ms
378ms Fetch
application/json 3.220.146.83
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://api.schemaapp.com/markup/entities?highlight_id=http%3A%2F%2Fschemaapp.com%2Fresources%2FTagLookupOmniLinkedEntity_6760f8d1501e20.85355480&highlight_config=%7B%22%40id%22%3A%22http%3A%2F%2Fschemaapp.com%2Fresources%2FTagLookupOmniLinkedEntity_6760f8d1501e20.85355480%22%2C%22xPath-input%22%3A%22%2Fhtml%2Fbody%2Fdiv%5B1%5D%2Fdiv%2Fdiv%5B2%5D%2Fdiv%2Fdiv%22%2C%22propertyPath%22%3A%5B%22mentions%22%5D%2C%22%40type%22%3A%22TagLookupOmniLinkedEntity%22%7D&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.220.146.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-146-83.compute-1.amazonaws.com
Software: /
Resource Hash: 7db94f3e110167f120a53a011f1b10ebd1ed9f846ca4e941adc0d3f45bcaa3ad

Request headers

x-account-id: Fortinet
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
accept: application/json
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-apigw-id: GUopTHLZIAMEokA=
x-amzn-trace-id: Root=1-67b8216e-60c72ab74a1b0f4c3968b8aa
access-control-allow-credentials: true
x-amzn-requestid: b3718e8e-586d-4457-a31a-96bd984f2c22
access-control-allow-origin: *
content-length: 6944
date: Fri, 21 Feb 2025 06:47:10 GMT
content-type: application/json
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Requested-With,cache-control,x-account-id

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
1 KB 164ms
162ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "4fd-60a2031eb4f40"
Age: 40137165
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: X8TjWuG6PFnlE4Ov2PCJQfCpfspklffy7TBgStrj3wvEFLpMYs0pkw==
Date: Fri, 21 Feb 2025 06:47:09 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 1277
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fortisandbox-blog-autoit-volumehits.png
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1739925568051/ 45 KB
0 2ms
2ms Image
image/png 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

00faf2672d1c7fe5dd776ce57d1419d865fa5e057a3ec339c4cf6fbdd16a89f8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "b535-62e73fd6a9000"
Age: 193771
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 7pjSK7K_Sf2L061w2n249moLnIupSBl0OpbzSXskaNINkJ3j9GcV2Q==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/png
Last-Modified: Wed, 19 Feb 2025 00:39:28 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 753abf75c4fb02577e3748ad81a5ead0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 46389
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig02-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_936958755.img.jpeg/1739514956920/ 19 KB
0 2ms
2ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_936958755.img.jpeg/1739514956920/fig02-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

29fb3e46f5797eb7705973e16d533228a814c942e5a87d1b577ab50ac9b05341

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "4b3c-62e146308ab00"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Cbce1mTsL0dc3wri9SGPbvyhj7Qqfah4RoqauEP7qAjzAtwNdeS8Uw==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:35:56 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 19260
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig03-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1814506802.img.jpeg/1739515034228/ 144 KB
0 3ms
2ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1814506802.img.jpeg/1739515034228/fig03-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

8446bedaded69d8ebd347bf1653a1bacfc07325d08c89a09f253af9df95175fe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "23e1e-62e1467aeda80"
Age: 193827
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zkR_0Glry65m34Kvq6IcViCvp1iZq-hJ-kp0Sd2pJEG99zzzrE7m4Q==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:37:14 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Via: 1.1 d45137f973d454db77c647196f56613a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 146974
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig04-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_2101814459.img.jpeg/1739515396176/ 25 KB
0 3ms
3ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_2101814459.img.jpeg/1739515396176/fig04-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

9f72a396c065f740bdbd9b194c9533caf1c670c733bb111053e745c6c7b91b97

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "6201-62e147d428900"
Age: 194847
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: fNEWAYnlvISSGP9CxBebr-m3Imx_Ni9EWX-V9CFVb3Sn2WALF0Qaqw==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:43:16 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 25089
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig05-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_404017904.img.jpeg/1739515468833/ 124 KB
0 3ms
3ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_404017904.img.jpeg/1739515468833/fig05-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b2103a4f9f9282f68c2e6e5a56c449f2922be99270fa9910d19098b93afe2d26

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "1ee7d-62e14818d2b00"
Age: 193828
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 6Y5Qsr6QN8UqT68haHZk-NqxqlCGZDYF2BlLm6g54Axg-k4HsWM0vQ==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:44:28 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 126589
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig06-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1039437413.img.jpeg/1739515515194/ 26 KB
0 1ms
1ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1039437413.img.jpeg/1739515515194/fig06-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a41d192fd18c2f7cdbd088af95a56af9dee5b261ac9be6210bd0f922d19ec5ba

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "68fe-62e14845a54c0"
Age: 194847
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ONYpxmMc9I_Tvgfhc-hhSiwHZsmB_eHTnLzQWze0HWzW3rPB3SUV1g==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:45:15 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 753abf75c4fb02577e3748ad81a5ead0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 26878
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig07-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_306152618.img.jpeg/1739515562387/ 12 KB
0 1ms
1ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_306152618.img.jpeg/1739515562387/fig07-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b8ea1ecff9e21aef9388ba3961835b44ecd42defa908bb63658ba1cd5634f7da

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "2f03-62e1487277e80"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: qXinEvlVShWcqV1ChAA2QUcTBd9CoYYu1OREHs5gsOcJBd_bjPxYeQ==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:46:02 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 12035
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig08-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_447237101.img.jpeg/1739515613065/ 49 KB
0 1ms
1ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_447237101.img.jpeg/1739515613065/fig08-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

0e79e0cf390976782043cdd0e4fb66661c9f7d61652a98524e3daeb57bfd8e7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "c3dc-62e148a31b140"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: dry_mHkDWTly8js0SCnGET_wr0P5CD9UG0jUO4hNyuN9S0Ml4M83tg==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:46:53 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 fe40bff56d1483fa61dd95ff72f0b9c0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 50140
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig09-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_529918456.img.jpeg/1739515662566/ 33 KB
0 2ms
2ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_529918456.img.jpeg/1739515662566/fig09-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

15fad644065e1a49aa9afade708793103edcb1223e9bf5b6456f7cfe8b0e50a6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "85e6-62e148d1d5f80"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: rwAsHElECocmG578HWEwMfSGbZvB4BL_Mkcm8LUY7ZPe1NWge6Uhmg==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:47:42 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 753abf75c4fb02577e3748ad81a5ead0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 34278
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig10-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1785132483.img.jpeg/1739515746910/ 18 KB
0 2ms
2ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1785132483.img.jpeg/1739515746910/fig10-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

59b3bd516133fe0205b749b48d7472907a885938f7f46e08450349cd2ff808c6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "4822-62e14921f1c80"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: OoXahb9nWbtFhKi3UDmCpxmGbeQC7E5NxPTGinC0agQtheyD7j-LKg==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:49:06 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 d45137f973d454db77c647196f56613a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 18466
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig11-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_411259125.img.jpeg/1739515825609/ 167 KB
0 1ms
1ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_411259125.img.jpeg/1739515825609/fig11-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

a88c22cdf0f3c7434c98426d5b493aa7cf3f6d3757e350d13a440ec6d7982185

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "29cdf-62e1496d48e40"
Age: 193698
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: WnV1WpUUNNK-VtbSbsoy3Suf7BO7s0CCd3PsclTRkMUcEoP6MNubcA==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:50:25 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher1uswest1-28559594
Via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 171231
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig12-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_103943210.img.jpeg/1739515882975/ 60 KB
0 2ms
2ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_103943210.img.jpeg/1739515882975/fig12-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

e1fdc57bdb7295c9178d55076cd31466a661113cd89febcf10a2baa0e0dd5f27

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "ef0d-62e149a3a4e80"
Age: 194846
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ZP7nMqYhamwQPP5BIkLBKNrL_OnqJgHob6149kxVV-BUy3i56ijxuA==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:51:22 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 fe40bff56d1483fa61dd95ff72f0b9c0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 61197
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig13-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1083473347.img.jpeg/1739515939169/ 80 KB
0 2ms
2ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_1083473347.img.jpeg/1739515939169/fig13-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

e0488b186e4c346fa8984b89d4967f1ec74b1c5e4b08e001b0da1d54fcde0d57

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "1404f-62e149da00ec0"
Age: 194845
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 00BVS8MAFFpB1n4GQX8bLLdM5Hl1snRPv5xthrRWxjm9MSWM41PuCg==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:52:19 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 ff071fa99e74a44c6556cef90e125ca8.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 81999
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig14-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_2066966967.img.jpeg/1739515979526/ 49 KB
0 2ms
2ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_2066966967.img.jpeg/1739515979526/fig14-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

6d99c0d5a4651725b742a9c6d661473c568f48179c805c7fb5c13b2f4ce99653

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "c4f9-62e14a00268c0"
Age: 194845
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: iikzR-iDPV-etyK6fKDE42opODyAesUhW7LA4gREd9Zzp3KhktH_fQ==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:52:59 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 753abf75c4fb02577e3748ad81a5ead0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 50425
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK fig15-snake-keylogger-variant.jpeg
www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_608930024.img.jpeg/1739516069923/ 58 KB
0 1ms
1ms Image
image/jpeg 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant/_jcr_content/root/responsivegrid/table_content/par/image_608930024.img.jpeg/1739516069923/fig15-snake-keylogger-variant.jpeg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

26814e51f388a7fda526270be49fefb245a520cd056c10191cdca19da9b379bc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
ETag: "e707-62e14a55fb340"
Age: 194845
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: zVJiLw8AY-Gotaevv6Uboeh6KdD1QglgCxgXvmFVV7V4vNB4ZjiTGw==
Date: Fri, 21 Feb 2025 04:35:54 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 14 Feb 2025 06:54:29 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=684000, public
X-Dispatcher: dispatcher2uswest1-28559771
Via: 1.1 d45137f973d454db77c647196f56613a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 59143
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 770 B
666 B 300ms
126ms XHR
application/json 99.83.231.3
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: b3f00dd807bc8453c695bfd454c55d8484da58f51d38d29175cdae892644879c

Request headers

Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.fortinet.com
content-length: 406
date: Fri, 21 Feb 2025 06:47:10 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 276ms
90ms Preflight 99.83.231.3
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Fri, 21 Feb 2025 06:47:09 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H2 200 s25857609150312
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LFQ6/ 43 B
373 B 491ms
161ms Image
image/gif 63.140.39.22
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.27.0-LFQ6/s25857609150312?AQB=1&ndh=1&pf=1&t=20%2F1%2F2025%2020%3A47%3A9%204%20600&sdid=2937BC24DF2950B6-52F1AF0DCD207C9C&mid=18559826991188167671787735043304583928&aamlh=7&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Afortisandbox-detects-evolving-snake-keylogger-variant&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&c7=Entire%20Site&c8=New&v25=18559826991188167671787735043304583928&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Afortisandbox-detects-evolving-snake-keylogger-variant&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.22 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-22.data.adobedc.net

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
pragma: no-cache
etag: 3736880169527934976-4618237585276925446
x-content-type-options: nosniff
expires: Thu, 20 Feb 2025 06:47:10 GMT
access-control-allow-origin: *
p3p: CP="This is not a P3P policy"
content-length: 43
date: Fri, 21 Feb 2025 06:47:10 GMT
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Feb 2025 06:47:10 GMT
vary: *
server: jag
content-type: image/gif;charset=utf-8

POST
H3 200 collect
www.google.com/ccm/ 0
0 499ms
172ms Ping
text/plain 142.251.40.164
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&scrsrc=www.googletagmanager.com&frm=0&rnd=1700386737.1740120430&dt=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&auid=82586790.1740120430&navt=n&npa=0&gtm=45be52k0v887005625za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732279~101732281~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&tft=1740120429879&tfd=4722&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c&gtm=45je52k0v893708426za200
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.164 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s81-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 43 B
61 B 486ms
172ms Script
text/javascript 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1740120429890&cv=11&fst=1740120429890&bg=ffffff&guid=ON&async=1&gtm=45be52k0v887005625za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732279~101732281~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f2.1e100.net

Software

cafe /

Resource Hash

77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 37
date: Fri, 21 Feb 2025 06:47:10 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 662878185
td.doubleclick.net/td/rul/ Frame D7B9 0
0 497ms
181ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/rul/662878185?random=1740120429890&cv=11&fst=1740120429890&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52k0v887005625za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732279~101732281~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 21 Feb 2025 06:47:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/5230/ Frame 0FB7 0
0 463ms
152ms Document
text/html 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/5230/sw_iframe.html?origin=https%3A%2F%2Fwww.fortinet.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c&gtm=45je52k0v893708426za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 131905
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Wed, 19 Feb 2025 18:08:45 GMT
expires: Thu, 19 Feb 2026 18:08:45 GMT
last-modified: Mon, 03 Feb 2025 09:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 4 KB
2 KB 379ms
174ms Script
text/javascript 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1740120429996&cv=11&fst=1740120429996&bg=ffffff&guid=ON&async=1&gtm=45be52k0za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732279~101732281~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f2.1e100.net

Software

cafe /

Resource Hash

9b47b08789f1d9916efd9bde720f8228117959676a35b78b10f89a3bea82cfa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2323
date: Fri, 21 Feb 2025 06:47:10 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 609297413
td.doubleclick.net/td/rul/ Frame D8BA 0
0 372ms
182ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/rul/609297413?random=1740120429996&cv=11&fst=1740120429996&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52k0za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732279~101732281~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 21 Feb 2025 06:47:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 td
www.googletagmanager.com/ 0
18 B 170ms
167ms Image
text/plain 142.251.40.200
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://www.googletagmanager.com/td?id=AW-609297413&v=3&t=t&pid=197342611&dl=www.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&tdp=AW-609297413;;0;2;0&frm=0&rtg=93708426&slo=11&hlo=17&lst=3&pcid=93708426&z=0
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.200 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s38-in-f8.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ascnsrsgtc:59:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgtc:59:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgtc:59:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgtc:59:0
content-length: 0
date: Fri, 21 Feb 2025 06:47:10 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 activityi;fledge=1;src=10050195;npa=0;auiddc=82586790.1740120430;ps=1;pcor=1000675094;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe52k0v9185241837za200zb893708426;gcd=13l...
td.doubleclick.net/td/fls/rul/ Frame FF2D 0
0 320ms
172ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10050195;npa=0;auiddc=82586790.1740120430;ps=1;pcor=1000675094;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe52k0v9185241837za200zb893708426;gcd=13l3l3l3l1l1;dma=0;tag_exp=101732282~101732284~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant?

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 21 Feb 2025 06:47:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;src=10050195;npa=0;auiddc=82586790.1740120430;ps=1;pcor=1000675094;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe52k0v9185241837za200zb893708426;gcd=13l3l3l3l1l1;...
ad.doubleclick.net/ 42 B
65 B 545ms
229ms Image
image/gif 142.251.40.166
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;src=10050195;npa=0;auiddc=82586790.1740120430;ps=1;pcor=1000675094;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe52k0v9185241837za200zb893708426;gcd=13l3l3l3l1l1;dma=0;tag_exp=101732282~101732284~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant?

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.166 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Fri, 21 Feb 2025 06:47:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET activity;register_conversion=1;src=10050195;npa=0;auiddc=82586790.1740120430;ps=1;pcor=1000675094;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe52k0v9185241837za200zb89370...
ad.doubleclick.net/ 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
245 B 169ms
169ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=ipv6&q=%7B%22address%22%3A%222a04%3Ac604%3A615%3A1%3A%3A6%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:10 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:10 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/ 4 KB
2 KB 258ms
182ms Script
text/javascript 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/729495989/?random=1740120430131&cv=11&fst=1740120430131&bg=ffffff&guid=ON&async=1&gtm=45be52k0za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732282~101732284~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f2.1e100.net

Software

cafe /

Resource Hash

7f02b91b05ef460439ea413a097e19ff7c42187afb94276355ccccf77d4a356c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2318
date: Fri, 21 Feb 2025 06:47:10 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 729495989
td.doubleclick.net/td/rul/ Frame 0313 0
0 274ms
194ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/rul/729495989?random=1740120430131&cv=11&fst=1740120430131&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52k0za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732282~101732284~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 21 Feb 2025 06:47:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 494ms
171ms Fetch
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-38BQ9XFDT4&gtm=45je52k0v9191763579za200&_p=1740120428377&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101732282~101732284~102067808~102453103~102482433~102539968~102558064~102587591~102605417~102640600~102658453&cid=1920509264.1740120430&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1740120430&sct=1&seg=0&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&dt=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=5190
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"ascnsrsggc:86:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.fortinet.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:86:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 21 Feb 2025 06:47:10 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 47 KB
17 KB 634ms
301ms Script
application/javascript 2a02:6ea0:c454::1
CDN77 Datacamp Li...

General

Check archive.org

Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
Software: BunnyCDN-NY1-885 /
Resource Hash: ea59b04200b193261e6d40c283fece2bdb18157129e0c93843c9fa69d1819827

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "67b50602-bd22"
cdn-fileserver: 622
date: Fri, 21 Feb 2025 06:47:10 GMT
cdn-storageserver: NY-353
last-modified: Tue, 18 Feb 2025 22:13:22 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 02/18/2025 22:19:39
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 724d1dba9c7aac9f2422d45f8c3a5407
cdn-pullzone: 293267
cdn-proxyver: 1.19
access-control-allow-origin: *
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: US

GET
H3 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
64 B 176ms
176ms Image
image/gif 142.251.40.164
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1740120429996&cv=11&fst=1740117600000&bg=ffffff&guid=ON&async=1&gtm=45be52k0za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732279~101732281~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCjtLzMzs4MogIyMmHPBfSmJPNbc6vzpBdnTw&random=3805843037&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.164 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 21 Feb 2025 06:47:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/729495989/ 42 B
64 B 173ms
173ms Image
image/gif 142.251.40.164
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/729495989/?random=1740120430131&cv=11&fst=1740117600000&bg=ffffff&guid=ON&async=1&gtm=45be52k0za200zb893708426&gcd=13l3l3l3l1l1&dma=0&tag_exp=101732282~101732284~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&hn=www.googleadservices.com&frm=0&tiba=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&npa=0&pscdl=noapi&auid=82586790.1740120430&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCjtLzMDmK-1LELXscyJfXXu4q7DrNKTr-oJQ&random=964612093&rmt_tld=0&ipr=y

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.164 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 21 Feb 2025 06:47:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 www.fortinet.com.json Show response
script.crazyegg.com/pages/data-scripts/0117/0786/sampling/ Frame 9ED9 46 B
309 B 103ms
100ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0117/0786/sampling/www.fortinet.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/c7deac18f0e7b90e6cef3f0fe19c780a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9111932368e8635721db2225b3b23fa38cff5b8e639ee64ac1ca3e1439b15ccb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 57526
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 21 Feb 2025 06:47:10 GMT
content-type: application/json
last-modified: Thu, 20 Feb 2025 14:48:03 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 9154c8928c5ded38-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 65
ce-version: 11.5.352
server: cloudflare

OPTIONS
H2 204 clock
tracking.crazyegg.com/ Frame 0
0 475ms
166ms Preflight 3.133.162.222
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1740120430552&tk=329ee1373036c5ddcda74cf257baa0a6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.133.162.222 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-133-162-222.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public, max-age=86400
date: Fri, 21 Feb 2025 06:47:10 GMT
server: awselb/2.0
vary: Access-Control-Request-Headers, Origin, Access-Control-Request-Method

POST
H2 200 clock Show response
tracking.crazyegg.com/ Frame 9ED9 41 B
147 B 174ms
173ms XHR
text/plain 3.133.162.222
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking.crazyegg.com/clock?u=1170786&st=424000&t=1740120430552&tk=329ee1373036c5ddcda74cf257baa0a6
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/c7deac18f0e7b90e6cef3f0fe19c780a.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.133.162.222 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-133-162-222.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 56b4e46029065aa102f2c2adbfb169ec47250dacb6dc1e18245338829a892309

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-type: application/json
Referer

Response headers

cache-control: no-store
access-control-allow-origin: *
content-length: 41
date: Fri, 21 Feb 2025 06:47:11 GMT
content-type: text/plain
server: awselb/2.0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
244 B 172ms
171ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A10%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A09%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%221006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:10 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:10 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx

GET
H2 200 api.min.css
a.omappapi.com/app/js/ 10 KB
3 KB 537ms
163ms Stylesheet
text/css 2a02:6ea0:c454::1
CDN77 Datacamp Li...

General

Check archive.org

Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
Software: BunnyCDN-NY1-885 /
Resource Hash: 50dfcc07e51f99ff7853a87bbb34e3c1dd7eba92f2f4b344882e317a01d39f42

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "67b50614-2644"
cdn-fileserver: 749
date: Fri, 21 Feb 2025 06:47:11 GMT
cdn-storageserver: NY-427
last-modified: Tue, 18 Feb 2025 22:13:40 GMT
content-type: text/css
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 02/21/2025 06:45:01
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 3a30edfa20fdaa4226277bf98f9f6a08
cdn-pullzone: 293267
cdn-proxyver: 1.19
access-control-allow-origin: *
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: US

GET
H2 401 39852 Show response
api.omappapi.com/v2/embed/ 165 B
592 B 480ms
300ms XHR
application/json 2606:4700::6812:309
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:309 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-user-agent: standard--
cf-cache-status: DYNAMIC
expires: Fri, 21 Feb 2025 06:48:29 GMT
x-cache: Error from cloudfront
x-amz-cf-id: vdAz7yBjviCA7KaMGWhDy4gb6b1GLrhffrrgSuEN5nYbwapnknfoBQ==
date: Fri, 21 Feb 2025 06:47:11 GMT
x-cache-config: 0 0
content-type: application/json
vary: Accept-Encoding, User-Agent
access-control-allow-headers: X-CSRF-Token
cache-control: public, max-age=120, stale-while-revalidate=1800
via: 1.1 dbb1a0d298f6a202c2f5a2e11bef88fe.cloudfront.net (CloudFront)
cf-ray: 9154c8975e422f45-LAX
access-control-allow-origin: *
content-length: 165
x-amz-cf-pop: SFO53-P6
server: cloudflare

GET
H2 200 3edfc62df3b0882f.js Show response
client-registry.mutinycdn.com/personalize/client/ 66 KB
21 KB 394ms
210ms Script
application/javascript 151.101.1.91
FASTLY

General

Check archive.org

Download Go to

Full URL: https://client-registry.mutinycdn.com/personalize/client/3edfc62df3b0882f.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.91 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0ef8a857fb190698798842ca59adccf3a2bc47e56d46cd25c1faef2a68848f62

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "eaed91d6557c8f658dc32510b0a96ef1"
x-amz-version-id: lxBwQVdk2pF54jUYaKBNK2Hnh8zRzkhz
age: 1565
access-control-allow-methods: GET, HEAD
x-cache: HIT
x-country-code: US
date: Fri, 21 Feb 2025 06:47:11 GMT
last-modified: Fri, 07 Feb 2025 21:44:03 GMT
content-type: application/javascript
x-served-by: cache-lax-kwhp1940074-LAX
x-cache-hits: 0
x-amz-id-2: mhE7mq314XYtNHORVOSZls2xrFk2xyZ0275IjmbbAGhTCap5ktTXYxno1ee+xCHOzTst+2WcnV4=
x-edge-datacenter: LAX
vary: X-Continent-Code, Accept-Encoding
cache-control: s-maxage=3600, max-age=0
x-continent-code: NA
x-connection-speed: broadband
via: 1.1 varnish
x-amz-request-id: MCERGH8475RGZMS1
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20474
x-edge-region: US-West
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 318ms
134ms Script
text/javascript 2606:4700::6812:1347
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1347 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-cache-status: HIT
age: 70859
via: 1.1 google
cf-ray: 9154c899b87c08ca-LAX
expires: Fri, 21 Feb 2025 07:07:11 GMT
date: Fri, 21 Feb 2025 06:47:11 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK tag.js Show response
abm-tracking.demandscience.com/ 2 KB
2 KB 349ms
112ms Script
application/javascript 52.32.164.86
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://abm-tracking.demandscience.com/tag.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 1885fa140df271c97bf904d43f5385b84aa7458ff60cc20dae89ca4e9df959d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: public, max-age=0
ETag: W/"879-19321dea034"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2169
Date: Fri, 21 Feb 2025 06:47:11 GMT
Content-Type: application/javascript; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Tue, 12 Nov 2024 19:34:18 GMT

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ 161 B
711 B 410ms
134ms Script
text/javascript 216.200.232.253
PAEDAE-INC

General

Check archive.org

Download Go to

Full URL

https://pixel.mathtag.com/event/js?mt_id=1629896&mt_adid=260855&mt_exem=&mt_excl=&v2=&v3=&s1=&s2=&s3=&v1=en:blog:threat-research:fortisandbox-detects-evolving-snake-keylogger-variant

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.200.232.253 Frederick, United States, ASN30419 (PAEDAE-INC, US),

Reverse DNS

Software

MT3 1737 bf9dc90 master ord ord-pixel-x34 config_version:"495" /

Resource Hash

98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457

Security Headers

Name	Value
Strict-Transport-Security	31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Strict-Transport-Security: 31536000
Cache-Control: no-cache
Content-Encoding: gzip
Connection: close
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Fri, 21 Feb 2025 06:47:11 GMT
X-XSS-Protection: 0
Content-Type: text/javascript
Server: MT3 1737 bf9dc90 master ord ord-pixel-x34 config_version:"495"

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
244 B 170ms
169ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A10%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%222010%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:11 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:11 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
439 B 167ms
166ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1740120431733&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&version=2.4
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
ibc_rate_tier: 1247773
Referer: https://www.fortinet.com/

Response headers

x-goog-metageneration: 2
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Fri, 21 Feb 2025 07:47:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AHMx-iH6yBL9LJkntNvcHF07rZKpXNG5CS2Ls4v-4ErTKPTc71hu192jbLVbBUnIDsXKffnY
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 335ms
157ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1247773&r=1740120431733&ref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 21 Feb 2025 06:47:11 GMT
expires: Fri, 21 Feb 2025 06:47:11 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AHMx-iG9zpTjbYvp7zpySQAtxh08XWroFAJGK4CeRFiRbcl2SFT0ilGA5d8WKJXEHMyX9_oL

GET
H2 200 fp.min.js Show response
cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/ 33 KB
14 KB 256ms
82ms Script
application/javascript 2a04:4e42:400::485
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY"
age: 2974
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 21 Feb 2025 06:47:11 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220049-FRA, cache-bur-kbur8200162-BUR
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13749
x-jsd-version: 3.4.2

GET
H2 200 site-visitors Show response
intentstream.contanuity.com/api/ 61 B
319 B 115ms
114ms Fetch
application/json 44.226.187.177
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

edf61f5e80302ecb8585243b41cc158f5bfc5d0cde2b606f693a8b269ba8e4b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
x-pixel-auth: true
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=15724800; includeSubdomains
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 61
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/json; charset=utf-8
vary: origin
server: nginx

OPTIONS
H2 200 site-visitors
intentstream.contanuity.com/api/ Frame 0
0 343ms
109ms Preflight 44.226.187.177
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://intentstream.contanuity.com/api/site-visitors?pageIdentifier=fortinet_2712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.226.187.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-226-187-177.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-pixel-auth
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-pixel-auth
access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
content-length: 0
date: Fri, 21 Feb 2025 06:47:12 GMT
server: nginx
strict-transport-security: max-age=15724800; includeSubdomains

GET
H2 200 nr-spa-1.266.0.min.js Show response
js-agent.newrelic.com/ 108 KB
31 KB 263ms
84ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa-1.266.0.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2466cad59509908859124f92c1d9a358117a2e9231859ab82c854d986af17510

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=300
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
content-encoding: br
etag: "ad3dba456087d08c6f96b0af1901f44c"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
x-cache: HIT
content-length: 31930
date: Fri, 21 Feb 2025 06:47:12 GMT
last-modified: Tue, 17 Sep 2024 14:19:27 GMT
content-type: application/javascript
x-served-by: cache-bur-kbur8200053-BUR
x-cache-hits: 226
vary: Accept-Encoding

GET
H2 200 RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 2 KB
1 KB 159ms
158ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC190d282f2b9c4848b2ea08ca5751fa40-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

b22a895efde249e663db1f645f4e9cc1a6066bded058e4365e2b7c070d956f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 755
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC7be3d22b2fd6487ca9390477738587fe-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 819 B
781 B 161ms
160ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC7be3d22b2fd6487ca9390477738587fe-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

6026017670c2e2b0acf75588310ea4a83f66376178856a794da73e95d2f86625

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 501
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC407b573180554ea6b11eecdc31ecbd3f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 819 B
780 B 160ms
159ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC407b573180554ea6b11eecdc31ecbd3f-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

2863ff96543db6585df4b006edf7ce2f6eb15b4ba5fa99ebbf33e7ab64804129

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 500
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC8c594cd344f84ab89afc779d8f53fff4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 1 KB
835 B 163ms
162ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC8c594cd344f84ab89afc779d8f53fff4-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

f576d437b5a019f913f469aed109dfd84ddf97264921fca41149916d3898435c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 554
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC5915f5d7e33546579cd5fd510349ed90-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 722 B
740 B 163ms
163ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC5915f5d7e33546579cd5fd510349ed90-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

dacba039f33e6915437e5174c1eac36f65a037c17d5454b1f5bb27098aaa36e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 459
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC1d92f04752ae42a38e54de48cb85adf4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 661 B
672 B 164ms
163ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC1d92f04752ae42a38e54de48cb85adf4-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

a65f1137792645c10ccfc78877b207bc86f078e820487eecc34e9c28c9ee86b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 391
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf940460311f349b5af69d075bdef61d4-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 368 B
516 B 164ms
163ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RCf940460311f349b5af69d075bdef61d4-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

69af3fb7713773cdb9bdfff9bbcca4ffcf6a948b0dae39561b16a025328c5aaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 235
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 754 B
728 B 163ms
162ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RCcb6e8e438d1741e6854bf3a039a2565a-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

b952a18083af097956c11f4792853b10907433ab4013dcee46e580953c2564c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 447
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 2 KB
994 B 163ms
163ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RCbbd24be21a0f4115a18f29bb3fee2a7a-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

e197b66f21e74786f91206df05a7e76f5a731b883d00a42258ba9f009150544c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 713
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 1021 B
880 B 163ms
163ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RCf5bd1991cad84a7294a7b609189a1fa5-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

339f8860aa2ba8e815c99e1e668b35af5d8ec7fde7901ca691a670f675b72976

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 600
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCcd84e40d19c24776bef77836ab2f8df6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 819 B
781 B 311ms
310ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RCcd84e40d19c24776bef77836ab2f8df6-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

cdb64d1b6efbcd95d0708bc6e0b827c71841feddf6da1454f2f0e839e1c1c48c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 501
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 388 B
522 B 308ms
308ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC4daaa3cd330f4ee2934602a98dab7c5f-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

0ce943bce846991a9986a37aa4c13fdc877c65ae2cf691045c19a3143b60206e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 242
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf30ab81c91bc4e9c9063a3e8818e020f-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 706 B
730 B 307ms
306ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RCf30ab81c91bc4e9c9063a3e8818e020f-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

af74dae031b06dadee5dfe551cc71e4a6789abe5d36873dc9e7f753cef27fc8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 449
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 2 KB
1004 B 307ms
307ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

7195552bcda2596ebd8766f1a3495fed0e3b70ecb2d6f62ff0a3277bfce36d00

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 723
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/ 966 B
832 B 309ms
309ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/6b48dd982bfa/RC0829ccf7bc5a44478ae2705d4c111c37-source.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

e24a2a96c46d1401811a57e213516c02a46ff72f8a46210e8d08c4b40ef36691

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "5aa2d713d226b18b3498d0bee413d23d:1740001675.010387"
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 07:47:12 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.fortinet.com
content-length: 551
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/x-javascript
last-modified: Wed, 19 Feb 2025 21:47:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 p Show response
i.simpli.fi/ 798 B
761 B 167ms
156ms Script
application/javascript 34.86.110.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://i.simpli.fi/p?cid=339566&cb=sifi_att_42656._hp
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.86.110.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.110.86.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: eb1b3be7bee349ce6a0b001c05bc33766882f39784ee87bf0f247557158cd793

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding: gzip
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: openresty

GET
H/1.1 200
OK favicon.ico
www.fortinet.com/etc/designs/fortinet-blog/ 318 B
2 KB 169ms
167ms Other
image/vnd.microsoft.icon 2600:1f18:1492:1702:852f:d87f:6683:b05a
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet-blog/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f18:1492:1702:852f:d87f:6683:b05a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Response headers

X-Vhost: publish
Content-Encoding: gzip
ETag: "13e-565c628eb6a00-gzip"
Age: 1155047
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: PVhZcUvP61_8aZ_S7sCE8mSnywMO_3UPvQH0aS_QkvA5n9c_Wob1Sw==
Date: Fri, 07 Feb 2025 22:06:01 GMT
Content-Type: image/vnd.microsoft.icon
Last-Modified: Thu, 22 Feb 2018 05:17:28 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Cache-Control: max-age=2000000, public
X-Dispatcher: dispatcher1uswest1-28559594
Connection: keep-alive
Via: 1.1 ee9b452ef78932123abe17295c8c65be.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Content-Length: 133
X-XSS-Protection: 1; mode=block
X-Amz-Cf-Pop: IAD61-P2
Server: Apache

GET
H/1.1 200
OK https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant Show response
abm-tracking.demandscience.com/page-tracking/fortinet_2712/ 2 B
665 B 111ms
111ms Script
application/json 52.32.164.86
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://abm-tracking.demandscience.com/page-tracking/fortinet_2712/https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant?visitorId=13d54d9e5fb23c2c5d1a303757a2513d_1740120432142&&clientId=undefined&&cookieEnabled=true
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.32.164.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-164-86.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 21 Feb 2025 06:47:12 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

GET
H/1.1 200
OK spx Show response
dx.mountain.com/ 23 KB
6 KB 647ms
161ms Script
application/javascript 34.238.149.65
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32336&tdr=&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&cb=17272074040652696term=value
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.238.149.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-238-149-65.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: d49f0a8a5c37321b5ebac98914454e104f124b51ba68005df2b2ee202f50e488

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 3
expires: Thu, 01 Jan 1970 00:00:00 GMT
be: spx-prod
date: Fri, 21 Feb 2025 06:47:11 GMT
content-type: application/javascript;charset=utf-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: istio-envoy

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 57 KB
16 KB 445ms
139ms Script
application/javascript 146.75.32.157
FASTLY

General

Check archive.org

Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.32.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "4328e910de583ad53b3a7a76455af005+gzip"
accept-ranges: bytes
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15926
date: Fri, 21 Feb 2025 06:47:12 GMT
x-tw-cdn: FT
last-modified: Tue, 29 Oct 2024 20:04:45 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kjyo7100108-IAD
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
15 KB 494ms
159ms Script
application/javascript 2600:141b:f000:1e::1737:f346
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:f000:1e::1737:f346 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

01d3c44791671916a95a17e3810a0bbb0817110f01c035d6e0faadcbcc581d2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=86400
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14637
date: Fri, 21 Feb 2025 06:47:12 GMT
last-modified: Wed, 22 Jan 2025 19:41:57 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 22 KB
7 KB 489ms
159ms Script
text/javascript 44.218.226.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.226.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-226-74.compute-1.amazonaws.com
Software: /
Resource Hash: 10f2b3647f206dbf4eb3823804d50c9a5fd68b71001a8ecc1d72e6b377213a43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: max-age=5
content-encoding: gzip
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/javascript

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1773420&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

43 B
1 KB

163ms
163ms

Image
image/gif

68.67.179.166
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2

Protocol

Server

68.67.179.166 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 131d8518-7ea7-4350-a29f-f02ec2de5610
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 21 Feb 2025 06:47:12 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1773420%26t%3D2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.249; 162.245.206.249; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 092ab65f-3652-4381-b6ec-e8b9533b47db
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 21 Feb 2025 06:47:12 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?add=36113683
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

43 B
1 KB

155ms
155ms

Image
image/gif

68.67.160.184
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683

Protocol

Server

68.67.160.184 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: abad34a1-9c82-476b-a9c4-182a1fc59868
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 21 Feb 2025 06:47:12 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D36113683
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 7c06de5f-cce4-437b-bb32-c4279f7ffd83
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 21 Feb 2025 06:47:12 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 iztag.js Show response
tags.inzynk.io/0ulh3gex/ 34 B
428 B 523ms
158ms Script
application/octet-stream 2600:9000:21f9:1200:12:dfa9:e200:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.inzynk.io/0ulh3gex/iztag.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f9:1200:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-amz-version-id: 15XT7F8rursoJ6jHrhKIXrYdXTZkWasY
etag: "595f7fa79bc22a7029d2751228622eb4"
age: 63812
via: 1.1 7922a002a59b7f43e6eb47ceba9a3654.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 34
x-amz-cf-id: 4xtPFkwx1AlB3arIGC0uewtfhUiZlTNq-oZdvw1Suy9qdv_Q8G6iQA==
date: Thu, 20 Feb 2025 13:03:48 GMT
content-type: application/octet-stream
last-modified: Thu, 05 Sep 2024 13:11:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P10
x-amz-server-side-encryption: AES256

GET

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=3AAE8C15F97A41BB8B168E31745C5051

0
0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=3AAE8C15F97A41BB8B168E31745C5051
https://sync.outbrain.com/cookie-sync?p=smaato&initiation=partner&uid=1c670409b4&gdpr=0&gdpr_consent=

0
360 B

485ms
163ms

Image
text/plain

70.42.32.191
AS-OUTBRAIN

General

Check archive.org

Download Go to Show image

Full URL

https://sync.outbrain.com/cookie-sync?p=smaato&initiation=partner&uid=1c670409b4&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

70.42.32.191 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 0
date: Fri, 21 Feb 2025 06:47:13 GMT
x-traceid: f1ba54ba63abca941bba99005a539a94

Redirect headers

cache-control: no-cache, must-revalidate
location: https://sync.outbrain.com/cookie-sync?p=smaato&initiation=partner&uid=1c670409b4&gdpr=0&gdpr_consent=
via: 1.1 16ef2ce41ee63b7d045e809201991b04.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: 9u_BQdKPc_36AM1-Uood-FNUq3NZcnvruo5A2z8EeDX5Pza6LjsG9A==
date: Fri, 21 Feb 2025 06:47:13 GMT
x-amz-cf-pop: JFK52-P7
server: CloudFront

GET
H2

204

3AAE8C15F97A41BB8B168E31745C5051
sync.1rx.io/usersync/simplifi/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/3AAE8C15F97A41BB8B168E31745C5051

0
99 B

452ms
145ms

Image
text/plain

69.194.240.13
RHYTHMONE

General

Check archive.org

Download Go to Show image

Full URL: https://sync.1rx.io/usersync/simplifi/3AAE8C15F97A41BB8B168E31745C5051
Protocol: H2
Server: 69.194.240.13 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
date: Fri, 21 Feb 2025 06:47:04 GMT
pragma: no-cache

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.1rx.io/usersync/simplifi/3AAE8C15F97A41BB8B168E31745C5051
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 20 Feb 2025 06:47:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=3AAE8C15F97A41BB8B168E31745C5051&dongle=yf3
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=3AAE8C15F97A41BB8B168E31745C5051&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=

37 B
474 B

155ms
155ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=3AAE8C15F97A41BB8B168E31745C5051&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: /xuid?ld=1&mid=7969&xuid=3AAE8C15F97A41BB8B168E31745C5051&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 21 Feb 2025 06:47:13 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=3AAE8C15F97A41BB8B168E31745C5051

43 B
175 B

497ms
159ms

Image
image/gif

2600:1f10:4ce4:4a05:565e:7dc2:ecda:d7b1
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=3AAE8C15F97A41BB8B168E31745C5051
Protocol: H2
Server: 2600:1f10:4ce4:4a05:565e:7dc2:ecda:d7b1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://simplifi.partners.tremorhub.com/sync?UISF=3AAE8C15F97A41BB8B168E31745C5051
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 20 Feb 2025 06:47:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=3AAE8C15F97A41BB8B168E31745C5051
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=3AAE8C15F97A41BB8B168E31745C5051

95 B
428 B

111ms
110ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=3AAE8C15F97A41BB8B168E31745C5051

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

strict-transport-security: max-age=31536000
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=3AAE8C15F97A41BB8B168E31745C5051
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Fri, 21 Feb 2025 06:47:13 GMT
server: Jetty(11.0.13)

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=3AAE8C15F97A41BB8B168E31745C5051
https://d.agkn.com/pixel/10751/?che=1740120433208&ip=162.245.206.249&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D214760605165006269605
https://um.simpli.fi/aa_px?sk=214760605165006269605
https://um.simpli.fi/empty.gif

43 B
361 B

150ms
150ms

Image
image/gif

35.236.220.17
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

35.236.220.17 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

17.220.236.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 43
date: Fri, 21 Feb 2025 06:47:14 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
location: /empty.gif
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 142
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=3AAE8C15F97A41BB8B168E31745C5051
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=3AAE8C15F97A41BB8B168E31745C5051&ckls=true&ci=Wr75vbuWsa&nc=false&trid=287939548

43 B
1 KB

172ms
171ms

Image
image/gif

2600:9000:2840:8000:1b:6b7d:2300:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=3AAE8C15F97A41BB8B168E31745C5051&ckls=true&ci=Wr75vbuWsa&nc=false&trid=287939548
Protocol: H2
Server: 2600:9000:2840:8000:1b:6b7d:2300:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 b3003c57fbd2e21494d8839411ec9fa6.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: wIcxCHkMsyeVSNkBfhjkiM6UnqU3lN0MZOrjumekr1Ihw1JPnrmz0g==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=3AAE8C15F97A41BB8B168E31745C5051&ckls=true&ci=Wr75vbuWsa&nc=false&trid=287939548
pragma: no-cache
via: 1.1 b3003c57fbd2e21494d8839411ec9fa6.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: oHXTW6356y9LdGiuzalggGsv0Nf6DNa_O__tOgKCwwcBVWtrLQBFNw==

GET
H2

200

Pug
image2.pubmatic.com/AdServer/
Redirect Chain

https://um.simpli.fi/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3AAE8C15F97A41BB8B168E31745C5051

42 B
513 B

489ms
159ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3AAE8C15F97A41BB8B168E31745C5051
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3AAE8C15F97A41BB8B168E31745C5051
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 20 Feb 2025 06:47:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200

user-registering
ads.stickyadstv.com/
Redirect Chain

https://um.simpli.fi/freewheel
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=3AAE8C15F97A41BB8B168E31745C5051

43 B
654 B

657ms
153ms

Image
image/gif

63.251.28.230
FREEWHEEL

General

Check archive.org

Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=3AAE8C15F97A41BB8B168E31745C5051
Protocol: HTTP/1.1
Server: 63.251.28.230 Secaucus, United States, ASN26558 (FREEWHEEL, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
x-sticky-vk: 1740120433409045-276
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Date: Fri, 21 Feb 2025 06:47:13 GMT
Content-Type: image/gif
Server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=3AAE8C15F97A41BB8B168E31745C5051
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 20 Feb 2025 06:47:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

engine
pbid.pro-market.net/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=3AAE8C15F97A41BB8B168E31745C5051;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=3AAE8C15F97A41BB8B168E31745C5051;mimetype=img;sr
https://cms.analytics.yahoo.com/cms?partner_id=DATCS
https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS
https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-lXTqpV1E2pT8L6p35u0Otjhe3Z3YIBA8cjE-~A

43 B
401 B

138ms
130ms

Image
image/gif

2600:1901:0:8eee::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-lXTqpV1E2pT8L6p35u0Otjhe3Z3YIBA8cjE-~A
Protocol: H2
Server: 2600:1901:0:8eee:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
anserver: gapp1
expires: Mon, 1 Jan 1990 0:0:0 GMT
access-control-allow-origin: *
alt-svc: clear
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length: 43
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif
server: Apache-Coyote/1.1

Redirect headers

strict-transport-security: max-age=31536000
location: https://pbid.pro-market.net/engine?du=81&mimetype=img&csync=y-lXTqpV1E2pT8L6p35u0Otjhe3Z3YIBA8cjE-~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: text/html
server: ATS

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=3AAE8C15F97A41BB8B168E31745C5051&j=0
https://loadm.exelator.com/load/?p=204&g=2191&simid=3AAE8C15F97A41BB8B168E31745C5051&j=0&xl8blockcheck=1

0
771 B

163ms
162ms

Image
text/plain

52.0.156.250
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=3AAE8C15F97A41BB8B168E31745C5051&j=0&xl8blockcheck=1
Protocol: H2
Server: 52.0.156.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-156-250.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 21 Feb 2025 06:47:13 GMT
x-powered-by: Undertow/1
server: nginx
access-control-allow-credentials: true

Redirect headers

cache-control: no-cache
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=3AAE8C15F97A41BB8B168E31745C5051&j=0&xl8blockcheck=1
access-control-allow-credentials: true
content-length: 0
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif
x-powered-by: Undertow/1
server: nginx

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55964/
Redirect Chain

https://um.simpli.fi/yahoo
https://ups.analytics.yahoo.com/ups/55964/sync?uid=3AAE8C15F97A41BB8B168E31745C5051
https://ups.analytics.yahoo.com/ups/55964/sync?uid=3AAE8C15F97A41BB8B168E31745C5051&verify=true

0
123 B

162ms
162ms

Image
text/html

2001:4998:14:800::1001
YAHOO

General

Check archive.org

Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55964/sync?uid=3AAE8C15F97A41BB8B168E31745C5051&verify=true

Protocol

Server

2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Fri, 21 Feb 2025 06:47:13 GMT
age: 0
content-type: text/html
server: ATS
referrer-policy: no-referrer-when-downgrade

Redirect headers

strict-transport-security: max-age=31536000
location: https://ups.analytics.yahoo.com/ups/55964/sync?uid=3AAE8C15F97A41BB8B168E31745C5051&verify=true
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: text/html
server: ATS

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=3AAE8C15F97A41BB8B168E31745C5051

0
421 B

647ms
158ms

Image
text/plain

52.202.191.63
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=3AAE8C15F97A41BB8B168E31745C5051
Protocol: HTTP/1.1
Server: 52.202.191.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-191-63.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Date: Fri, 21 Feb 2025 06:47:12 GMT
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://sync.bfmio.com/sync?pid=141&uid=3AAE8C15F97A41BB8B168E31745C5051
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 20 Feb 2025 06:47:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

tpid=3AAE8C15F97A41BB8B168E31745C5051
bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=3AAE8C15F97A41BB8B168E31745C5051
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=3AAE8C15F97A41BB8B168E31745C5051

49 B
520 B

169ms
168ms

Image
image/gif

44.223.125.1
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=3AAE8C15F97A41BB8B168E31745C5051
Protocol: H2
Server: 44.223.125.1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-223-125-1.compute-1.amazonaws.com
Software: /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif
x-server: 10.40.49.205

Redirect headers

cache-control: no-cache
location: https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=3AAE8C15F97A41BB8B168E31745C5051
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 21 Feb 2025 06:47:13 GMT
x-server: 10.40.48.41

GET
H2

200

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=3AAE8C15F97A41BB8B168E31745C5051
https://ce.lijit.com/merge?pid=2&3pid=3AAE8C15F97A41BB8B168E31745C5051&dnr=1

43 B
511 B

170ms
170ms

Image
image/gif

52.55.40.41
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=3AAE8C15F97A41BB8B168E31745C5051&dnr=1
Protocol: H2
Server: 52.55.40.41 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-40-41.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://ce.lijit.com/merge?pid=2&3pid=3AAE8C15F97A41BB8B168E31745C5051&dnr=1
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 21 Feb 2025 06:47:13 GMT
vary: Accept-Encoding

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=3AAE8C15F97A41BB8B168E31745C5051
https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogM0FBRThDMTVGOTdBNDFCQjhCMTY4RTMxNzQ1QzUwNTEQABoNCPHC4L0GEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=530c995a5792a851bafbeb427c0c22b4b38be8c7024f72f5b960b66208b23541791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=530c995a5792a851bafbeb427c0c22b4b38be8c7024f72f5b960b66208b23541791426b5417dce21&rand=06205645

0
143 B

120ms
120ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=530c995a5792a851bafbeb427c0c22b4b38be8c7024f72f5b960b66208b23541791426b5417dce21&rand=06205645
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: B7AD3DC1ECA148309325C7FF4236B3BB Ref B: LAX311000112019 Ref C: 2025-02-21T06:47:13Z
x-li-fabric: prod-lor1
x-li-uuid: AAYuoVxRpEMfk5UFdB2m1g==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 21 Feb 2025 06:47:13 GMT

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=530c995a5792a851bafbeb427c0c22b4b38be8c7024f72f5b960b66208b23541791426b5417dce21&rand=06205645
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Fri, 21 Feb 2025 06:47:13 GMT

GET
H3

200

/
www.google.com/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1740120432128&cv=7&fst=1740120432128&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1207068312&cv=7&fst=1740120432128&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLH...
https://www.google.com/pagead/1p-conversion/1026675585/?random=1207068312&cv=7&fst=1740120432128&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrF...

42 B
64 B

178ms
177ms

Image
image/gif

142.251.40.164
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/1026675585/?random=1207068312&cv=7&fst=1740120432128&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECCOvMsQIIz86xAg&pscrd=IhMI4ImV4pXUiwMVsQBoCB12GBUNMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQCjtLzMh1LQ6jkcbxzTrZQQahCfSdvdAGUwfx9s9qKpbV1sC7sJJFgw&random=2240600174

Protocol

Server

142.251.40.164 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 21 Feb 2025 06:47:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://www.google.com/pagead/1p-conversion/1026675585/?random=1207068312&cv=7&fst=1740120432128&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQIIkMmxAgjTxbECCOvMsQIIz86xAg&pscrd=IhMI4ImV4pXUiwMVsQBoCB12GBUNMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhlodHRwczovL3d3dy5mb3J0aW5ldC5jb20v&is_vtc=1&cid=CAQSKQCjtLzMh1LQ6jkcbxzTrZQQahCfSdvdAGUwfx9s9qKpbV1sC7sJJFgw&random=2240600174
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Fri, 21 Feb 2025 06:47:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 214ms
212ms Image
text/plain 35.236.220.17
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.236.220.17 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

17.220.236.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET, POST, OPTIONS
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin: *
date: Fri, 21 Feb 2025 06:47:12 GMT
x-content-type-options: nosniff

GET
H2

200

setuid
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=3AAE8C15F97A41BB8B168E31745C5051

43 B
1 KB

167ms
164ms

Image
image/gif

68.67.160.184
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=66&code=3AAE8C15F97A41BB8B168E31745C5051

Protocol

Server

68.67.160.184 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.249; 162.245.206.249; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 8e82df7c-484e-493a-b7b4-94df56656ac3
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 21 Feb 2025 06:47:13 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://ib.adnxs.com/setuid?entity=66&code=3AAE8C15F97A41BB8B168E31745C5051
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 20 Feb 2025 06:47:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=3AAE8C15F97A41BB8B168E31745C5051&expires=365

42 B
1 KB

487ms
160ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=3AAE8C15F97A41BB8B168E31745C5051&expires=365
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 2e31b23176a0c93349f5f5f1dd9d9284
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=3AAE8C15F97A41BB8B168E31745C5051&expires=365
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 20 Feb 2025 06:47:12 GMT
access-control-allow-origin: *
content-length: 142
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=3AAE8C15F97A41BB8B168E31745C5051
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=3AAE8C15F97A41BB8B168E31745C5051

43 B
171 B

108ms
108ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=3AAE8C15F97A41BB8B168E31745C5051
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=3AAE8C15F97A41BB8B168E31745C5051
x-forwarded-for: 162.245.206.249
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_error=15

0
320 B

153ms
152ms

Image
text/plain

35.236.220.17
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=&google_error=15

Protocol

Server

35.236.220.17 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

17.220.236.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
expires: Thu, 20 Feb 2025 06:47:13 GMT
access-control-allow-origin: *
date: Fri, 21 Feb 2025 06:47:13 GMT
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

cache-control: no-cache, must-revalidate
location: https://um.simpli.fi/g_match?id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 249
date: Fri, 21 Feb 2025 06:47:13 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 207 KB
74 KB 177ms
176ms Script
application/javascript 142.251.40.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4NSPPXN

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.200 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

757a98f8bb846f157be017fa73ac1b103d4f8a71b07bfeae6506690a557c2adf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1245:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1245:0"}],}
expires: Fri, 21 Feb 2025 06:47:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 21 Feb 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1245:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1245:0
content-length: 75226
x-xss-protection: 0
server: Google Tag Manager

GET
BLOB 200
OK 0fcef6a7-3861-4ac6-85f9-17fdeb00138e
https://www.fortinet.com/ 43 B
0 Image
image/gif

General

Check archive.org

Download Go to Show image

Full URL: blob:https://www.fortinet.com/0fcef6a7-3861-4ac6-85f9-17fdeb00138e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H/1.1 200
OK tracking Show response
tracking.contanuity.com/ 2 B
769 B 344ms
112ms Script
application/json 54.203.236.163
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking.contanuity.com/tracking?visitorId=13d54d9e5fb23c2c5d1a303757a2513d_1740120432142&&clientId=undefined&&cookieEnabled=true
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.203.236.163 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-203-236-163.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate
Pragma: no-cache
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Expires: -1
Access-Control-Allow-Origin: *
Content-Length: 2
Date: Fri, 21 Feb 2025 06:47:12 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: Express
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

POST
H/1.1 200 NRJS-5566e73879405a23f6d Show response
bam.nr-data.net/1/ 188 B
637 B 328ms
149ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-5566e73879405a23f6d?a=1386204789&sa=1&v=1.266.0&t=Unnamed%20Transaction&rst=7180&ck=0&s=f733e9e209c53d56&ref=https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant&ptid=e0a467f9480d1bc7&af=err,spa,xhr,stn,ins&be=537&fe=6351&dc=1026&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1740120425157,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:58,%22c%22:58,%22s%22:213,%22ce%22:375,%22rq%22:376,%22rp%22:537,%22rpe%22:839,%22di%22:1556,%22ds%22:1556,%22de%22:1563,%22dc%22:6873,%22l%22:6873,%22le%22:6888%7D,%22navigation%22:%7B%7D%7D&fp=3312&fcp=3312
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 63a5dec586bfaa3fb7a65faccfda77c43d0c1144f6e517f01ae36a3b4198edb6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.fortinet.com/

Response headers

access-control-expose-headers: Date
timing-allow-origin: https://www.fortinet.com
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
cross-origin-resource-policy: cross-origin
access-control-allow-origin: https://www.fortinet.com
Content-Length: 188
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/plain
x-served-by: cache-bur-kbur8200059-BUR

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
244 B 169ms
169ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A11%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%223014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:12 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx

GET
H2 200 adsct
t.co/i/ 43 B
465 B 343ms
172ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=c85e9a87-5691-45a7-b4d9-3b8f7fc87b69&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bbbbacf6-1816-4fae-918a-995559f90641&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 1db272c2fc138ad5
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 1170d73139fe6c8905bda157b30db903984bddb037065b3b837a76ee7b27426c
cf-cache-status: DYNAMIC
cf-ray: 9154c8a1ef501024-LAX
x-response-time: 5
content-length: 43
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_p

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
213 B 352ms
116ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=c85e9a87-5691-45a7-b4d9-3b8f7fc87b69&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bbbbacf6-1816-4fae-918a-995559f90641&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6ezf&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 5a17ef112f9b0ea5
cache-control: no-cache, no-store, max-age=0
x-connection-hash: ccc68a3aeb2c25ab71aaff969b46123a67435a88b1fc9eef0d2824c4bfc5d710
x-response-time: 6
content-length: 43
date: Fri, 21 Feb 2025 06:47:12 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_p

GET
H2 200 adsct
t.co/i/ 43 B
625 B 221ms
164ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=0a872514-bea4-4959-b22b-66571511a2a0&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bbbbacf6-1816-4fae-918a-995559f90641&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: bf19f16e5a81ff6c
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 30a116154ff9603023127e958a2e45c8a4b7fa840d901c46b234d72c3d0dbb89
cf-cache-status: DYNAMIC
cf-ray: 9154c8a1ef541024-LAX
x-response-time: 5
content-length: 43
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_p

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
392 B 314ms
114ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=0a872514-bea4-4959-b22b-66571511a2a0&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bbbbacf6-1816-4fae-918a-995559f90641&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o72wb&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 4a612f3aeb40f748
cache-control: no-cache, no-store, max-age=0
x-connection-hash: ccc68a3aeb2c25ab71aaff969b46123a67435a88b1fc9eef0d2824c4bfc5d710
x-response-time: 4
content-length: 43
date: Fri, 21 Feb 2025 06:47:12 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_p

GET
H2 200 nr-spa-recorder-1.266.0.min.js Show response
js-agent.newrelic.com/ 71 KB
20 KB 93ms
93ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa-recorder-1.266.0.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dfe4299abe67b328635794581230b980af9c961749f00ad767376821afc90888

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=300
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
content-encoding: br
etag: "06b6585890329a5114f13ee5e6526235"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
x-cache: HIT
content-length: 20765
date: Fri, 21 Feb 2025 06:47:12 GMT
last-modified: Tue, 17 Sep 2024 14:19:27 GMT
content-type: application/javascript
x-served-by: cache-bur-kbur8200053-BUR
x-cache-hits: 0
vary: Accept-Encoding

POST
H/1.1 200 blobs Show response
bam.nr-data.net/browser/ 24 B
343 B 250ms
244ms XHR
image/gif 162.247.243.29
FASTLY

General

Check archive.org

Download Go to

Full URL: https://bam.nr-data.net/browser/blobs?browser_monitoring_key=NRJS-5566e73879405a23f6d&type=BrowserSessionChunk&app_id=1386204789&protocol_version=0&timestamp=1740120424650&attributes=entityGuid%3DNDEwMTg2OXxCUk9XU0VSfEFQUExJQ0FUSU9OfDEzODYyMDQ3ODk%26harvestId%3Df733e9e209c53d56_e0a467f9480d1bc7_1%26trace.firstTimestamp%3D1740120424650%26trace.lastTimestamp%3D1740120432170%26trace.nodes%3D181%26trace.originTimestamp%3D1740120424650%26agentVersion%3D1.266.0%26firstSessionHarvest%3Dtrue%26ptid%3De0a467f9480d1bc7%26session%3Df733e9e209c53d56
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.fortinet.com/

Response headers

Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-origin: https://www.fortinet.com
Content-Length: 24
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: image/gif
x-served-by: cache-bur-kbur8200059-BUR

POST
H/1.1 200 NRJS-5566e73879405a23f6d Show response
bam.nr-data.net/events/1/ 24 B
343 B 321ms
156ms XHR
image/gif 162.247.243.29
FASTLY

General

Check archive.org

Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-5566e73879405a23f6d?a=1386204789&sa=1&v=1.266.0&t=Unnamed%20Transaction&rst=7540&ck=0&s=f733e9e209c53d56&ref=https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant&ptid=e0a467f9480d1bc7
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.fortinet.com/

Response headers

Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
access-control-allow-origin: https://www.fortinet.com
Content-Length: 24
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: image/gif
x-served-by: cache-lax-kwhp1940058-LAX

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 160ms
159ms Stylesheet
text/css 44.218.226.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.226.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-226-74.compute-1.amazonaws.com
Software: /
Resource Hash: 80cc6f6a35ae700a714f5dd4104469247c6a2c06c6abfc7a32f9714f819829cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 478ms
160ms Fetch
image/jpeg 44.218.226.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.226.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-226-74.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/jpeg

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
765 B 355ms
165ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: *
Referer: https://www.fortinet.com/

Response headers

x-li-pop: afd-prod-lva1-x
content-encoding: gzip
x-fs-uuid: 00062ea15c461b67951cdd3eda32ef58
x-msedge-ref: Ref A: 636393C0BCAD41389BEBEF8DFF5A9D08 Ref B: LAX311000114035 Ref C: 2025-02-21T06:47:12Z
x-li-fabric: prod-lva1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYuoVxGG2eVHN0+2jLvWA==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&li_adsId=b3f2ac7e-b7a2-4c58-8783-07eb02474b56&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&li_adsId=b3f2ac7e-b7a2-4c58-8783-07eb02474b56&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%252C2159050%252C4628290%252C6313418%26time%3D1740120432714%26li_adsId%3Db3f2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&li_adsId=b3f2ac7e-b7a2-4c58-8783-07eb02474b56&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fth...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&li_adsId=b3f2ac7e-b7a2-4c58-8783-07eb02474b56&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Ft...

0
489 B

353ms
161ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&li_adsId=b3f2ac7e-b7a2-4c58-8783-07eb02474b56&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&cookiesTest=true&liSync=true&e_ipv6=AQJ-xHDTThtU9QAAAZUnQqOBiByaO3drzWGBPQNYRFvP1PZlWUSGt36neqxgTnD9IkqXOg
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 2D2471ACB7B941CC9ADC7CCB8A94F415 Ref B: LAX311000108019 Ref C: 2025-02-21T06:47:13Z
x-li-fabric: prod-lor1
x-li-uuid: AAYuoVxTSX2AdiRzcIOm3A==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7120%2C2159050%2C4628290%2C6313418&time=1740120432714&li_adsId=b3f2ac7e-b7a2-4c58-8783-07eb02474b56&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&cookiesTest=true&liSync=true&e_ipv6=AQJ-xHDTThtU9QAAAZUnQqOBiByaO3drzWGBPQNYRFvP1PZlWUSGt36neqxgTnD9IkqXOg
x-msedge-ref: Ref A: 3689C407274048F2AD44C3DBE1766E7F Ref B: LAX311000112019 Ref C: 2025-02-21T06:47:13Z
x-li-fabric: prod-lor1
x-li-uuid: AAYuoVxOl+PW+RiqDkKW2Q==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 21 Feb 2025 06:47:12 GMT

GET
H2

200

fortisandbox-detects-evolving-snake-keylogger-variant;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3182714311601.0938
10104846.fls.doubleclick.net/activityi;dc_pre=CL_uo-KV1IsDFdpkRwEd14IMSA;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/ Frame 16A5
Redirect Chain

https://10104846.fls.doubleclick.net/activityi;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant;dc_lat=;...
https://10104846.fls.doubleclick.net/activityi;dc_pre=CL_uo-KV1IsDFdpkRwEd14IMSA;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolvin...

0
0

188ms
187ms

Document
text/html

142.250.80.102
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://10104846.fls.doubleclick.net/activityi;dc_pre=CL_uo-KV1IsDFdpkRwEd14IMSA;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3182714311601.0938?

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.102 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 2032
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 21 Feb 2025 06:47:13 GMT
expires: Fri, 21 Feb 2025 06:47:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 21 Feb 2025 06:47:13 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10104846.fls.doubleclick.net/activityi;dc_pre=CL_uo-KV1IsDFdpkRwEd14IMSA;src=10104846;type=sitew00;cat=sitew006;u3=https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=3182714311601.0938?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 240 KB
61 KB 317ms
152ms Script
application/x-javascript 31.13.65.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.65.7 Lithia Springs, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-atl3.fbcdn.net

Software

Resource Hash

33de96f9ee14b4c4b9362f9434a3938273241c6be5c8092b2a29e2bbed8d4a08

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-234UakGQ' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-234UakGQ' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: MODERATE; q=0.3, rtt=150, rtx=0, c=24, mss=1232, tbw=8319, tp=13, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: wADcHeikRhy9SKrD1e5NsLmg3l02ns+jILpYfwm8MqG6iHsQduscMMHmJPD8+1ARVITDXcpX/ha06FerHBM8Og==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62625
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 siteanalyze_6033413.js Show response
siteimproveanalytics.com/js/ 39 KB
12 KB 208ms
109ms Script
application/javascript 104.21.16.1
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6033413.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 207cf18dd6b5c283f5c1f2ad622dbdf57b13426727b840de705a66405fc37ea4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "7d99f692e7d388db5d44c38318be4b32"
age: 2832
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wS348MMECLk08hzQxaTNH9FeR7djF8%2BjsZemg0yEQYhp3KEtFpM4bapnJx2VWgIpYqInYPAj5FIYlRz%2BVsoCLfmq2osRD5L6EzkxnC%2B9OsNsehxhyNDF2MOOofim6yoOVlp37l1uV%2FcSmXk%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 19 Nov 2024 19:07:27 GMT
vary: Accept-Encoding
x-amz-id-2: EzvJAkb8K+bV5U4g8jNmz9fvRHfWkKAeUn9uTGIKcoSj4LryCBloH23nRn6FQ3dAllI2HH1tMO4=
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=86400, no-transform
cross-origin-resource-policy: cross-origin
x-amz-request-id: QN21N3P549RC7KGS
cf-ray: 9154c8a38dc32eae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11721
server: cloudflare

GET
H2 200 adsct
t.co/i/ 43 B
164 B 149ms
148ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=3b599873-1a1b-4fb3-9574-9ce3ec98857d&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bbbbacf6-1816-4fae-918a-995559f90641&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 3fda07ddae22bb1b
cache-control: no-cache, no-store, max-age=0
x-connection-hash: a7cfbc3c1cc8c5535f3f9095909c2515a4906d7035c01de934b83f09dede937a
cf-cache-status: DYNAMIC
cf-ray: 9154c8a2e88d1024-LAX
x-response-time: 6
content-length: 43
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_p

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
215 B 121ms
118ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=3b599873-1a1b-4fb3-9574-9ce3ec98857d&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bbbbacf6-1816-4fae-918a-995559f90641&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxlzj&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_p /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: c72c6fb536465669
cache-control: no-cache, no-store, max-age=0
x-connection-hash: ccc68a3aeb2c25ab71aaff969b46123a67435a88b1fc9eef0d2824c4bfc5d710
x-response-time: 7
content-length: 43
date: Fri, 21 Feb 2025 06:47:12 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_p

GET
H2 200 nr-spa-compressor-1.266.0.min.js Show response
js-agent.newrelic.com/ 7 KB
3 KB 90ms
89ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa-compressor-1.266.0.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

291587250267a545dd5f4d7e6bcbda349c5eee0d7af6f1e41d18005753d614f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Origin: https://www.fortinet.com
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=300
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
content-encoding: br
etag: "398fe8f80e8d0f4674996e7fa3ffbb89"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
x-cache: HIT
content-length: 3488
date: Fri, 21 Feb 2025 06:47:12 GMT
last-modified: Tue, 17 Sep 2024 14:19:27 GMT
content-type: application/javascript
x-served-by: cache-bur-kbur8200053-BUR
x-cache-hits: 0
vary: Accept-Encoding

GET
H/1.1 200
OK is Show response
3.212.39.155/ 32 B
437 B 623ms
157ms Fetch
text/plain 3.212.39.155
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://3.212.39.155/is?cb=1740120432846
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.212.39.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-39-155.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: b8456dc3fa1b21befbd118255798b93dce7d488a1c4c2380de4e6cb7a5866d83

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 0
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
content-length: 32
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: text/plain;charset=utf-8
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 api.min.css Show response
a.omappapi.com/app/js/ 10 KB
0 1ms
1ms Fetch
text/css 2a02:6ea0:c454::1
CDN77 Datacamp Li...

General

Check archive.org

Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-spa-1.266.0.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c454::1 New York, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS
Software: BunnyCDN-NY1-885 /
Resource Hash: 50dfcc07e51f99ff7853a87bbb34e3c1dd7eba92f2f4b344882e317a01d39f42

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

perma-cache: HIT
cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: "67b50614-2644"
cdn-fileserver: 749
date: Fri, 21 Feb 2025 06:47:11 GMT
cdn-storageserver: NY-427
last-modified: Tue, 18 Feb 2025 22:13:40 GMT
content-type: text/css
vary: Accept-Encoding
cdn-cache: HIT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cdn-cachedat: 02/21/2025 06:45:01
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 3a30edfa20fdaa4226277bf98f9f6a08
cdn-pullzone: 293267
cdn-proxyver: 1.19
access-control-allow-origin: *
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: US

GET
H2 200 sa.css Show response
tags.srv.stackadapt.com/ 65 B
0 2ms
2ms Fetch
text/css 44.218.226.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-spa-1.266.0.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.226.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-226-74.compute-1.amazonaws.com
Software: /
Resource Hash: 80cc6f6a35ae700a714f5dd4104469247c6a2c06c6abfc7a32f9714f819829cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Fri, 21 Feb 2025 06:47:12 GMT
content-type: text/css

GET

usersync
tracking.contanuity.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=13d54d9e5fb23c2c5d1a303757a2513d_1740120432142
https://match.prod.bidr.io/cookie-sync/contanuity?buyer_user_id=13d54d9e5fb23c2c5d1a303757a2513d_1740120432142&_bee_ppp=1
https://tracking.contanuity.com/usersync?bwcookie=AADv3E7PcEMAABZyUs5i2Q

0
0

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
333 B 158ms
157ms XHR
text/plain 44.218.226.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=NZlTqtu9vowXrexrDZrWUA&is_js=true&landing_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&t=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&tip=11qLUid6MSmK0TAsZQsDFUgBBtCo0t9BYroTHrVFVoY&host=https%3A%2F%2Fwww.fortinet.com&sa_conv_data_css_value=%270-aa3aa382-9021-5855-5691-890f0f99d008%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9aa3aa382902158555691890f0f99d008a2f5cef9&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIMyQqcwWIpd4hhf0fIQ_yEPmzY_2EzIEhkJDXTzSuvTfENYBGAQg8MLgvQYwAToEVSpAukIEjck6og.O1W9bhKCMihZBP3nosrk%252F4THIem3nvuVqs4jU0xLZBU&sa-user-id-v2=s%253AqjqjgpAhWFVWkYkPD5nQCKL1zvk.yHsKXVKFcwuznW1ZWD09GKoaKrLg5APKp%252BOXeBDuKDI&sa-user-id=s%253A0-aa3aa382-9021-5855-5691-890f0f99d008.79bkjdERieLEjEj0oQtD4ZhbtBFZ5IgMFMMvJJ0fPTY
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.226.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-226-74.compute-1.amazonaws.com
Software: /
Resource Hash: e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
content-length: 138
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
0 0ms
0ms Fetch
image/jpeg 44.218.226.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.226.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-226-74.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/jpeg

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
333 B 157ms
156ms XHR
text/plain 44.218.226.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=kcdPQbWRrikzOaW0iSiObg&is_js=true&landing_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&t=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&tip=11qLUid6MSmK0TAsZQsDFUgBBtCo0t9BYroTHrVFVoY&host=https%3A%2F%2Fwww.fortinet.com&sa_conv_data_css_value=%270-aa3aa382-9021-5855-5691-890f0f99d008%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9aa3aa382902158555691890f0f99d008a2f5cef9&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIMyQqcwWIpd4hhf0fIQ_yEPmzY_2EzIEhkJDXTzSuvTfENYBGAQg8MLgvQYwAToEVSpAukIEjck6og.O1W9bhKCMihZBP3nosrk%252F4THIem3nvuVqs4jU0xLZBU&sa-user-id-v2=s%253AqjqjgpAhWFVWkYkPD5nQCKL1zvk.yHsKXVKFcwuznW1ZWD09GKoaKrLg5APKp%252BOXeBDuKDI&sa-user-id=s%253A0-aa3aa382-9021-5855-5691-890f0f99d008.79bkjdERieLEjEj0oQtD4ZhbtBFZ5IgMFMMvJJ0fPTY
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.226.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-226-74.compute-1.amazonaws.com
Software: /
Resource Hash: 1ebf4765c39e042319d8cc3f4070ef97c89b6e18a3f28bcec0bb7e58a9042a8f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.fortinet.com
content-length: 138
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 image.aspx
6033413.global.siteimproveanalytics.io/ 34 B
210 B 503ms
155ms Image
image/gif 3.223.133.185
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://6033413.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&title=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&res=1600x1200&accountid=6033413&rt=8252&prev=1413a1a6-5c99-1527-5933-89ad0a559999&luid=d81e1d72-52ba-28d3-c973-31f4499f175d&rnd=86215
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.133.185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-133-185.compute-1.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

expires: Fri, 21 Feb 2025 06:47:13 UTC
access-control-allow-origin: *
cache-control: private, max-age=0
content-length: 34
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif
cross-origin-resource-policy: cross-origin

GET
H3 200 177020962864941 Show response
connect.facebook.net/signals/config/ 70 KB
14 KB 153ms
153ms Script
application/x-javascript 31.13.65.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.184&r=stable&domain=www.fortinet.com&hme=93c44828b638838a88daf3a14a90ff297f7fc4ade758f21de5500c9f17542765&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C194%2C191%2C192%2C34%2C144%2C15%2C50%2C198%2C197%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.65.7 Lithia Springs, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-atl3.fbcdn.net

Software

Resource Hash

a3c5d7ffd7033b7824d528a186332cd8cd897f2c18947b4392a96fe566cfd5dc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-kXuwYLhP' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-kXuwYLhP' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: MODERATE; q=0.3, rtt=151, rtx=0, c=80, mss=1232, tbw=74771, tp=71, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: MH1Pz+bMfElG528HSOxmJIMgXA2ee8bqQ0oqDYP4Dlb/4ra0DDJcDAT8zXpiX+tsHwRzVeTFZmjuO9nLo+qppw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
content-length: 14575
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
244 B 168ms
167ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A12%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:13 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx

GET
H3 200 /
www.facebook.com/tr/ 0
16 B 330ms
152ms Image
text/plain 31.13.65.36
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&rl=&if=false&ts=1740120433713&sw=1600&sh=1200&v=2.9.184&r=stable&ec=0&o=12318&fbp=fb.1.1740120433711.934924463134719865&ler=empty&cdl=API_unavailable&it=1740120433542&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.65.36 Lithia Springs, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-atl3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: MODERATE; q=0.3, rtt=151, rtx=0, c=24, mss=1232, tbw=8364, tp=14, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 21 Feb 2025 06:47:13 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
200 B 432ms
254ms Image
image/png 31.13.65.36
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&rl=&if=false&ts=1740120433713&sw=1600&sh=1200&v=2.9.184&r=stable&ec=0&o=12318&fbp=fb.1.1740120433711.934924463134719865&ler=empty&cdl=API_unavailable&it=1740120433542&coo=false&rqm=FGET

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.65.36 Lithia Springs, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-atl3.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-jiAoNrCB' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7473760351762699289"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xf77e856888256f1c","source_keys":["1"]}],"aggregatable_values":{"1":10922},"aggregatable_source_registration_time":"exclude","filters":{"3":["1473595392721544"]},"debug_reporting":true,"debug_key":"1756328711188820907"}
date: Fri, 21 Feb 2025 06:47:14 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: k+NnXocL3UbeyIt5qt5WoOSD9UOJRKlXczrFIwvmw/jVr0P0hx+0tqm4QHlfBgyIzuiYaU/G4pPr9UbDOQFFZw==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7473760351762699289", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-jiAoNrCB' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: MODERATE; q=0.3, rtt=151, rtx=0, c=24, mss=1232, tbw=8684, tp=16, tpl=0, uplat=102, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
196 B 121ms
119ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 8EED1F18A1D5458184079355BFEA0F0A Ref B: LAX311000112019 Ref C: 2025-02-21T06:47:13Z
x-li-fabric: prod-lor1
access-control-allow-credentials: true
x-li-uuid: AAYuoVxV1uH4DaOPZ8Q5bA==
x-li-proto: http/2
access-control-allow-origin: https://www.fortinet.com
x-cache: CONFIG_NOCACHE
date: Fri, 21 Feb 2025 06:47:13 GMT
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
244 B 169ms
168ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A13%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225015%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:14 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:14 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx

GET
H/1.1 200
OK st Show response
px.mountain.com/ 2 KB
1 KB 471ms
115ms Script
application/javascript 35.85.106.161
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1920509264.1740120430&shpt=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221740120430%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3Anull%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221920509264.1740120430%22%2C%22shpt%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221740120430.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22FpXhBNUyNpyacaiLIWs0xsSi7IHFJ5im%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1740120430.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221740120430%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3Anull%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&cb=17272074040652696term%3Dvalue&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cmediamath%3Dtrue%2Cga4%3Dtrue%2Cappnexus%3Dtrue
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.85.106.161 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-85-106-161.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 031efeac74277ec5268304403e9296483d4d7f8d47a2076021c33353c7079dd4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 1
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 21 Feb 2025 06:47:15 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

OPTIONS
H2 200 pagecount
api.schemaapp.com/ Frame 0
0 167ms
166ms Preflight
application/json 3.220.146.83
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://api.schemaapp.com/pagecount
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.220.146.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-146-83.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-account-id,x-api-key
Access-Control-Request-Method: POST
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,x-account-id
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Fri, 21 Feb 2025 06:47:14 GMT
x-amz-apigw-id: GUoqBEMEoAMElGw=
x-amzn-requestid: 6bbc7239-b52a-4b91-bc9d-04af0b4b987e
x-amzn-trace-id: Root=1-67b82172-03deff096fb674c822b09e2e

POST
H2 200 pagecount Show response
api.schemaapp.com/ 256 B
461 B 693ms
689ms Fetch
application/json 3.220.146.83
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://api.schemaapp.com/pagecount
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.220.146.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-146-83.compute-1.amazonaws.com
Software: /
Resource Hash: b7a4e6b125b5b2e072e039af07fcd01e083e02c8cd2163345befd230295c4fcb

Request headers

x-account-id: Fortinet
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
accept: application/json
content-type: application/json
x-api-key: BiQcqdttWn7eunp8jvxM5oZl3DIx08J42LtTmaaj

Response headers

x-amzn-requestid: 962068fc-3482-46e1-9471-4b325871b616
access-control-allow-origin: *
content-length: 256
date: Fri, 21 Feb 2025 06:47:15 GMT
x-amz-apigw-id: GUoqDEOpIAMEqfw=
content-type: application/json
x-amzn-trace-id: Root=1-67b82173-0b76453d0c2609583e5e2f64

GET
H/1.1 200
OK gs Show response
gs.mountain.com/ 144 B
733 B 459ms
115ms Script
application/javascript 35.81.162.201
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://gs.mountain.com/gs
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.81.162.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-81-162-201.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: f59e6a6cabc4d8d4e5cb4159b47fc999f0efe4b4a37fd60a31803547e1f51c03

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 1
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-application-context: application:prod:8080
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 21 Feb 2025 06:47:15 GMT
content-length: 144
content-type: application/javascript;charset=utf-8
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
244 B 168ms
168ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A14%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%226015%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:15 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:15 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx

GET
H/1.1 200
OK st Show response
px.mountain.com/ 6 KB
2 KB 364ms
136ms Script
application/javascript 35.85.106.161
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://px.mountain.com/st?ga_tracking_id=G-38BQ9XFDT4%3BG-JH142QCQCJ&ga_client_id=1920509264.1740120430&shpt=FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs&ga_info=%7B%22status%22%3A%22One%20of%20the%20required%20properties%20not%20evaluated%20(mntnis%2C%20ga_tracking_id%2C%20ga_client_id%2C%20shpt).%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221740120430%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3Anull%7D%5D%2C%22ga_tracking_id%22%3A%22G-38BQ9XFDT4%3BG-JH142QCQCJ%22%2C%22ga_client_id%22%3A%221920509264.1740120430%22%2C%22shpt%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%2C%22dcm_cid%22%3A%221740120430.1%22%2C%22adobe_analytics%22%3A%7B%7D%2C%22mntnis%22%3A%22FpXhBNUyNpyacaiLIWs0xsSi7IHFJ5im%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A9%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%7D%7D&dcm_cid=1740120430.1&available_ga=%5B%7B%22id%22%3A%22G-38BQ9XFDT4%22%2C%22sess_id%22%3A%221740120430%22%7D%2C%7B%22id%22%3A%22G-JH142QCQCJ%22%2C%22sess_id%22%3Anull%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32336&plh=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&shadditional=sh_conversion%3DSHBLOCK%2Cgoogletagmanager%3Dtrue%2Cmediamath%3Dtrue%2Cga4%3Dtrue%2Cappnexus%3Dtrue&cb=1740120435268171&shguid=bf61b0ff-6b5f-3176-927a-dcc1a9e560cc&shgts=1740120435731
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.85.106.161 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-85-106-161.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: ddcc5821fd0d67a7ceb666e87f4ece0885bf44371526388d8f1b0d0fd2ea87d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

transfer-encoding: chunked
content-encoding: gzip
x-envoy-upstream-service-time: 20
connection: close
access-control-allow-origin: *
p3p: CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
date: Fri, 21 Feb 2025 06:47:16 GMT
content-type: application/javascript;charset=utf-8
server: istio-envoy

GET
H/1.1

200
OK

tdsync
px.steelhousemedia.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=af9c40e0-f01f-11ef-b18c-27d9a85f31e5&gdpr=&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=af9c40e0-f01f-11ef-b18c-27d9a85f31e5&gdpr=&gdpr_consent=
https://px.steelhousemedia.com/tdsync?tdid=038306c5-b09e-44f0-aa43-dec7ea9053d4&shguid=af9c40e0-f01f-11ef-b18c-27d9a85f31e5

0
319 B

475ms
125ms

Image
text/plain

54.244.159.189
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://px.steelhousemedia.com/tdsync?tdid=038306c5-b09e-44f0-aa43-dec7ea9053d4&shguid=af9c40e0-f01f-11ef-b18c-27d9a85f31e5
Protocol: HTTP/1.1
Server: 54.244.159.189 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-244-159-189.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

x-envoy-upstream-service-time: 11
connection: close
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Fri, 21 Feb 2025 06:47:17 GMT
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, x-requested-with, X-Custom-Header

Redirect headers

location: https://px.steelhousemedia.com/tdsync?tdid=038306c5-b09e-44f0-aa43-dec7ea9053d4&shguid=af9c40e0-f01f-11ef-b18c-27d9a85f31e5
content-length: 277
date: Fri, 21 Feb 2025 06:47:16 GMT
server: Kestrel

GET
H2

200

ibs:dpid=903&dpuuid=038306c5-b09e-44f0-aa43-dec7ea9053d4
dpm.demdex.net/
Redirect Chain

https://insight.adsrvr.org/track/evnt/?adv=6s0zaeu&ct=0:0bi0elf&fmt=3
https://dpm.demdex.net/ibs:dpid=903&dpuuid=e338613f-52f5-4056-9665-9975a649e7db&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=038306c5-b09e-44f0-aa43-dec7ea9053d4

42 B
714 B

161ms
161ms

Image
image/gif

44.208.97.160
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=038306c5-b09e-44f0-aa43-dec7ea9053d4

Protocol

Server

44.208.97.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-208-97-160.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v071-0d2441f8a.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: tbHUmQfsTGk=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 21 Feb 2025 06:47:16 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=038306c5-b09e-44f0-aa43-dec7ea9053d4
content-length: 189
date: Fri, 21 Feb 2025 06:47:16 GMT
server: Kestrel

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
244 B 169ms
169ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227016%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:16 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:16 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
245 B 170ms
169ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A16%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%228016%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:17 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:17 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
244 B 168ms
168ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A17%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%229017%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:18 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:18 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
245 B 174ms
174ms Image
image/gif 23.34.59.33
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=5eeecf22b2d12a77a14639dce97b7a36&svisitor=null&visitor=cf82f414-6c55-45f7-84ad-996e82a181b6&session=1f4c69da-3424-493d-82ad-fb5579338ddf&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2021%20Feb%202025%2006%3A47%3A18%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%2210017%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20how%20FortiSandbox%205.0%20detected%20this%20malware%2C%20the%20behavioral%20indicators%20it%20leveraged%20for%20identification%2C%20and%20Snake%20Keylogger%27s%20technique%20to%20evade%20detection%20and%20analysis.%22%2C%22keywords%22%3A%22FortiGuard%20Labs%20Threat%20Research%2CFortiGuard%20Labs%20Threat%20Research%2Ckeylogger%22%2C%22title%22%3A%22FortiSandbox%205.0%20Detects%20Evolving%20Snake%20Keylogger%20Variant%20%7C%20FortiGuard%20Labs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&pageViewId=b9e0ca0e-1450-43d9-87e4-042739a8caf0&ipv6=2a04%3Ac604%3A615%3A1%3A%3A6&v=1.1.32

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Referer: https://www.fortinet.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 21 Feb 2025 06:47:19 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 21 Feb 2025 06:47:19 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ad.doubleclick.net
URL: https://ad.doubleclick.net/activity;register_conversion=1;src=10050195;npa=0;auiddc=82586790.1740120430;ps=1;pcor=1000675094;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe52k0v9185241837za200zb893708426;gcd=13l3l3l3l1l1;dma=0;tag_exp=101732282~101732284~102067808~102482433~102539968~102558064~102587591~102605417~102640600~102658453;epver=2;~oref=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant?

Domain: stags.bluekai.com
URL: https://stags.bluekai.com/site/29931?id=3AAE8C15F97A41BB8B168E31745C5051

Domain: tracking.contanuity.com
URL: https://tracking.contanuity.com/usersync?bwcookie=AADv3E7PcEMAABZyUs5i2Q

Verdicts & Comments Add Verdict or Comment

150 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

117 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-21 12:07:42	Name: cookiesession1 Value: 678A3E5AC3B06625311DA79875AC3E6F
.fortinet.com/	1970-01-21 12:07:36	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Thu+Feb+20+2025+20%3A47%3A07+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=202312.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=82419049-66da-4a6a-8fba-a5e9b3be4b17&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.fortinet.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-21 07:41:12	Name: demdex Value: 18216757739523472551750050414122619760
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
.fortinet.com/	1970-01-21 03:22:02	Name: mboxEdgeCluster Value: 34
.dpm.demdex.net/	1970-01-21 07:41:12	Name: dpm Value: 18216757739523472551750050414122619760
.fortinet.com/	1970-01-21 12:58:00	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 179643557%7CMCIDTS%7C20141%7CMCMID%7C18559826991188167671787735043304583928%7CMCAAMLH-1740725227%7C7%7CMCAAMB-1740725227%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1740127627s%7CNONE%7CMCSYNCSOP%7C411-20148%7CvVersion%7C5.5.0
.fortinet.com/	1970-01-21 03:23:26	Name: _uetsid Value: abcc2a70f01f11efb5be7df3ef036df3
.fortinet.com/	1970-01-21 12:43:36	Name: _uetvid Value: abcc4db0f01f11efbd73097a7fdbe845
.bing.com/	1970-01-21 12:43:36	Name: MUID Value: 37616518F0EB62E332947082F105632D
.bat.bing.com/	1970-01-21 03:32:05	Name: MR Value: 0
.simpli.fi/	1970-01-21 12:09:02	Name: suid Value: 3AAE8C15F97A41BB8B168E31745C5051
www.fortinet.com/	1970-01-21 12:58:00	Name: _gd_visitor Value: cf82f414-6c55-45f7-84ad-996e82a181b6
www.fortinet.com/	1970-01-21 03:22:14	Name: _gd_session Value: 1f4c69da-3424-493d-82ad-fb5579338ddf
.fortinet.com/	1970-01-21 03:22:02	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Ffortisandbox-detects-evolving-snake-keylogger-variant
.fortinet.com/	1970-01-21 05:31:36	Name: s_getNewRepeat Value: 1740120429781-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.fortinet.com/	1970-01-21 05:31:36	Name: _gcl_au Value: 1.1.82586790.1740120430
www.fortinet.com/	1970-01-21 03:22:00	Name: dicbo_id Value: %7B%22dicbo_fetch%22%3A1740120429945%7D
.fortinet.com/	1970-01-21 12:58:00	Name: _ga_38BQ9XFDT4 Value: GS1.1.1740120430.1.0.1740120430.0.0.0
.fortinet.com/	1970-01-21 12:58:00	Name: _ga Value: GA1.1.1920509264.1740120430
.fortinet.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.doubleclick.net/	1970-01-21 07:41:12	Name: receive-cookie-deprecation Value: 1
www.fortinet.com/	1970-01-21 12:58:00	Name: _omappvp Value: oCps8nmtzszG96opsOh77VzUm5Dl8PjUOy1WGo45plHY4vuYbXZ4zc1CL0t6bA61KcIJUUtgFFfctUKDccnuhAhLctEjok0w
www.fortinet.com/	1970-01-21 03:22:01	Name: _omappvs Value: 1740120430994
.fortinet.com/	1970-01-21 03:23:26	Name: _ce.clock_data Value: 92%2C162.245.206.249%2C1%2C97c8d7303a7d32359ab28720b7810e9d%2CChrome%2CUS
.fortinet.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.fortinet.com/	1970-01-21 12:07:36	Name: _ce.s Value: v~e1546f7cc4d0a483c6e95e57e8377267b56f0aa8~lcw~1740120431210~vir~new~lva~1740120430549~vpv~0~v11.cs~424000~v11.s~ad310ca0-f01f-11ef-b1af-7f06ef7cae0c~lcw~1740120431211
.techtarget.com/	1970-01-21 03:22:02	Name: __cf_bm Value: qNE8f6s7hHhpSqQcuq66N.Tc0abgI3cHYAT7VT04qK8-1740120431-1.0.1.1-7AD5MoF1md4tWVwR4m6EDkUdPOeOYu1hAq06gQWqtFvEfofE8mvNqrPyD51i_NWeJKlVqRNJkGWg16KAKfr.8w
.simpli.fi/	1970-01-21 03:32:05	Name: uid_syncd_secure Value: true
www.fortinet.com/	1970-01-21 03:32:05	Name: AWSALB Value: p9yWyGVkBanaPnsWHpbGsfAq8pYOy3zQlnE32y3hdj/8OIGC3/IZRjLjYemZ5SJ26aU2Iodx7v5TOx6x9w801fmcbTONMVqJfnmYYcXfwFmA3WtWpWXDaaHd7KimYpi81+r3M4m0EbzPe9Ze0swdXFQ3DUeDhduwYH6naNcOrlbtt6FjUMBRjHjPLc8p/wcwfdaC3uJiE6ijK6Qqnt7jbg4EMiq9CjuR
www.fortinet.com/	1970-01-21 03:32:05	Name: AWSALBCORS Value: CPQ8Tay95J8A3Yf3ZLUWsO5lae7pK17UyP6xEFFYbxYnwqAm+v+fjE2tpJTfwVHzlk9KrdAhwa98nG/feTxYFkGuGge+93nT0qGvr+uUkMTjunZA6FpmK2W1MW1diCVqr/BHkKTZbjKxbHlG2f/wddAd6gmR0XakznQRYqYZ9x4C0Nt8NCTcjjcFMNfRDbacaMZ12H0R/Zt78ViRo2BoezccwrKwxGwZ
abm-tracking.demandscience.com/	1970-01-21 12:58:00	Name: userId Value: 13d54d9e5fb23c2c5d1a303757a2513d_1740120432142
.adnxs.com/	1970-01-21 12:58:00	Name: receive-cookie-deprecation Value: 1
tags.srv.stackadapt.com/	1970-01-21 12:07:36	Name: sa-user-id Value: s%3A0-aa3aa382-9021-5855-5691-890f0f99d008.79bkjdERieLEjEj0oQtD4ZhbtBFZ5IgMFMMvJJ0fPTY
.srv.stackadapt.com/	1970-01-21 12:07:36	Name: sa-user-id Value: s%3A0-aa3aa382-9021-5855-5691-890f0f99d008.79bkjdERieLEjEj0oQtD4ZhbtBFZ5IgMFMMvJJ0fPTY
tags.srv.stackadapt.com/	1970-01-21 12:07:36	Name: sa-user-id-v2 Value: s%3AqjqjgpAhWFVWkYkPD5nQCKL1zvk.yHsKXVKFcwuznW1ZWD09GKoaKrLg5APKp%2BOXeBDuKDI
.srv.stackadapt.com/	1970-01-21 12:07:36	Name: sa-user-id-v2 Value: s%3AqjqjgpAhWFVWkYkPD5nQCKL1zvk.yHsKXVKFcwuznW1ZWD09GKoaKrLg5APKp%2BOXeBDuKDI
tags.srv.stackadapt.com/	1970-01-21 12:07:36	Name: sa-user-id-v3 Value: s%3AAQAKIMyQqcwWIpd4hhf0fIQ_yEPmzY_2EzIEhkJDXTzSuvTfENYBGAQg8MLgvQYwAToEVSpAukIEjck6og.O1W9bhKCMihZBP3nosrk%2F4THIem3nvuVqs4jU0xLZBU
.srv.stackadapt.com/	1970-01-21 12:07:36	Name: sa-user-id-v3 Value: s%3AAQAKIMyQqcwWIpd4hhf0fIQ_yEPmzY_2EzIEhkJDXTzSuvTfENYBGAQg8MLgvQYwAToEVSpAukIEjck6og.O1W9bhKCMihZBP3nosrk%2F4THIem3nvuVqs4jU0xLZBU
www.fortinet.com/	1970-01-21 12:07:36	Name: sa-user-id Value: s%253A0-aa3aa382-9021-5855-5691-890f0f99d008.79bkjdERieLEjEj0oQtD4ZhbtBFZ5IgMFMMvJJ0fPTY
www.fortinet.com/	1970-01-21 12:07:36	Name: sa-user-id-v2 Value: s%253AqjqjgpAhWFVWkYkPD5nQCKL1zvk.yHsKXVKFcwuznW1ZWD09GKoaKrLg5APKp%252BOXeBDuKDI
www.fortinet.com/	1970-01-21 12:07:36	Name: sa-user-id-v3 Value: s%253AAQAKIMyQqcwWIpd4hhf0fIQ_yEPmzY_2EzIEhkJDXTzSuvTfENYBGAQg8MLgvQYwAToEVSpAukIEjck6og.O1W9bhKCMihZBP3nosrk%252F4THIem3nvuVqs4jU0xLZBU
.adnxs.com/	1970-01-21 05:31:36	Name: XANDR_PANID Value: KJXsJ8UgLuqTVbH8hDHhwxOs9TomNJ9-VlDNGorhu_2unD_3gbPWSXg0hw6vyaQEL-bXQ_w8qo7OnI7GSkAXjcrhBC__VHg8jc9uhDS0S4o.
.adnxs.com/	1970-01-21 05:31:36	Name: uuid2 Value: 6758318933676360005
tracking.contanuity.com/	1970-01-21 12:58:00	Name: userId Value: 13d54d9e5fb23c2c5d1a303757a2513d_1740120432142
tracking.contanuity.com/	1970-01-21 12:58:00	Name: clientId Value: undefined
.tapad.com/	1970-01-21 04:48:24	Name: TapAd_TS Value: 1740120433000
.tapad.com/	1970-01-21 04:48:24	Name: TapAd_DID Value: c54584d9-791c-4bcd-9f5d-973c667b48c9
.t.co/	1970-01-21 12:58:00	Name: muc_ads Value: 66719786-47d9-46d3-86a0-3e3ece053f3a
.t.co/	1970-01-21 03:22:02	Name: __cf_bm Value: HypNTKD8zzq4iQg7ms.XVtK.xXE2RobvSOLxwps6FMQ-1740120433-1.0.1.1-i8yLl80iwaqDxFT8KCthSIRSR_mq8ALK6JojO7S.cgy1cQJaJs9KuL0u631qhLfW_o64BXxfJs6QEu2OKCrcwQ
.adnxs.com/	1970-01-21 05:31:36	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2ImGu$)f3!A#FR.TOK`YT5U?QgGsAiJ%Pbl!N9sigR9li+oHLfoE<Ojd(:e:6Nncxq6Ao1Uc+ki'G=f=kW*g0D(F^^CX
.tapad.com/	1970-01-21 04:48:24	Name: TapAd_3WAY_SYNCS Value:
.3lift.com/	1970-01-21 05:31:36	Name: tluidp Value: 354027759184324199361
.3lift.com/	1970-01-21 05:31:36	Name: tluid Value: 354027759184324199361
.doubleclick.net/	1970-01-21 12:58:00	Name: IDE Value: AHWqTUmVVVDt6Eoh2ptae29rplun9IlWMw7KtngLq04CJjf3Uo7nfLyXHm-M77C0
.twitter.com/	1970-01-21 12:58:00	Name: personalization_id Value: "v1_TYB0pRxBNIv04W+3pQYTzg=="
.linkedin.com/	1970-01-21 05:31:36	Name: li_sugr Value: 9b97396a-fd41-4da4-bdd2-bfd9cac143a1
.linkedin.com/	1970-01-21 12:07:36	Name: bcookie Value: "v=2&4034fca8-36f7-408e-88af-5e76d1a19882"
.linkedin.com/	1970-01-21 03:23:26	Name: lidc Value: "b=OGST03:s=O:r=O:a=O:p=O:g=3476:u=1:x=1:i=1740120433:t=1740206833:v=2:sig=AQG451xN2EefNg9jf_dLfrR166odJdME"
.openx.net/	1970-01-21 12:07:36	Name: i Value: 6b9022fa-f22f-4195-8c4b-20a26727fd80\|1740120433
.smaato.net/	1970-01-21 03:52:14	Name: SCM Value: 1c670409b4
.smaato.net/	1970-01-21 03:52:14	Name: SCMo Value: 1c670409b4
.smaato.net/	1970-01-21 03:52:14	Name: SCM1001136 Value: 1c670409b4
.rlcdn.com/	1970-01-21 12:07:36	Name: rlas3 Value: nJrds2Akl3zgsqwpX/zW5Ndv7LolqxaEsqtpud+heEM=
.pro-market.net/	1970-01-21 04:05:12	Name: anHistory Value: "18xpb1751qbrk+2+!#7')!W#+QY"
.intentiq.com/	1970-01-21 12:58:00	Name: IQver Value: 1.9
.intentiq.com/	1970-01-21 12:58:00	Name: intentIQ Value: Wr75vbuWsa
.agkn.com/	1970-01-21 12:07:36	Name: ab Value: 0001%3AnyRnaX%2BFKp0yG53IC4FKITaNOB8zpPGj
.yahoo.com/	1970-01-21 12:07:58	Name: A3 Value: d=AQABBHEhuGcCEFXRBb1tHC_q59XMxkioXX0FEgEBAQFyuWfCZ9wr0iMA_eMAAA&S=AQAAAnddeINR0LQgGKwO5BLjC9I
.pubmatic.com/	1970-01-21 04:05:12	Name: KRTBCOOKIE_148 Value: 19421-uid:3AAE8C15F97A41BB8B168E31745C5051&KRTB&23486-uid:3AAE8C15F97A41BB8B168E31745C5051&KRTB&23489-uid:3AAE8C15F97A41BB8B168E31745C5051
.pubmatic.com/	1970-01-21 04:05:12	Name: PugT Value: 1740120433
.linkedin.com/	1970-01-21 04:05:12	Name: UserMatchHistory Value: AQL55X9Sh1ZJugAAAZUnQqJ1wSAzEZDs9wU7BSyy3MB_Ez5uHMFgm1HeVgBo4loBu90miIA4By-N5w
.linkedin.com/	1970-01-21 04:05:12	Name: AnalyticsSyncHistory Value: AQLKl_7gRurnqAAAAZUnQqJ1Wyli4-mdwJYQ7aCsqNp4MOzFNsl1AH2kM7wRUPNqcMEqWLIMhGFecrg1GMH_ww
.lijit.com/	1970-01-21 12:07:36	Name: ljt_reader Value: KNTXAQZHl3Ctz8nKSeiKFqwv
www.fortinet.com/	1970-01-21 03:23:28	Name: aa_cc Value: US
www.fortinet.com/	1970-01-21 03:23:28	Name: aa_cn Value: United%20States
www.fortinet.com/	1970-01-21 03:23:28	Name: 6scexist Value: true
.exelator.com/	1970-01-21 06:14:48	Name: EE Value: "171ff1d39a13a2ebf615e1d6cb8d8109"
.rlcdn.com/	1970-01-21 04:48:24	Name: pxrc Value: CPHC4L0GEgUI6AcQABIFCOhHEAA=
.fortinet.com/	1970-01-21 12:58:00	Name: nmstat Value: 1413a1a6-5c99-1527-5933-89ad0a559999
.rubiconproject.com/	1970-01-21 12:07:36	Name: audit_p Value: 1\|XIgLzu2e0XRmF+C1Hh+7YhAkb+jje9UAvwZB/opbJjaCZIg+tqclAXy7mIYTMHJIV1A9kmsEHX2M1KxoLazIt04KBbjzRD/Y5dDZuxGLGk+MFwACFB6Vt7geRb1LiP//7EsjwICWtjEa2qVk4wXALiXHpagWmf+4SpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.rubiconproject.com/	1970-01-21 12:07:36	Name: khaos Value: M7EERZJV-A-6N4T
.rubiconproject.com/	1970-01-21 12:07:36	Name: khaos_p Value: M7EERZJV-A-6N4T
.rubiconproject.com/	1970-01-21 12:07:36	Name: audit Value: 1\|XIgLzu2e0XRmF+C1Hh+7YhAkb+jje9UAvwZB/opbJjaCZIg+tqclAXy7mIYTMHJIV1A9kmsEHX2M1KxoLazIt04KBbjzRD/Y5dDZuxGLGk+MFwACFB6Vt7geRb1LiP//7EsjwICWtjEa2qVk4wXALiXHpagWmf+4SpxNqhhzGypRm99a3bMoP35/bkYCLFZe
.rubiconproject.com/	1970-01-21 05:31:36	Name: receive-cookie-deprecation Value: 1
.fortinet.com/	1970-01-21 12:58:00	Name: mbox Value: session#c3e955b587de4bc6929c2552f7a85bcf#1740122294\|PC#c3e955b587de4bc6929c2552f7a85bcf.34_0#1803365229
.intentiq.com/	1970-01-21 12:58:00	Name: IQPData Value: 2734018297#1740120433371#0#1740120433371
.intentiq.com/	1970-01-21 12:58:00	Name: CSDT Value: UEQ6MTAwNDNfMCZVZFEwMEFu
.intentiq.com/	1970-01-21 12:58:00	Name: ASDT Value: 0
.intentiq.com/	1970-01-21 12:58:00	Name: intentIQCDate Value: 1740120433372
.www.linkedin.com/	1970-01-21 12:07:36	Name: bscookie Value: "v=1&2025022106471389cbf771-900d-425b-8c73-300a55567bf4AQHipPASG624in6_QOafSZ9EszPoAjF0"
.bfmio.com/	1970-01-21 12:07:36	Name: __141_cid Value: 3AAE8C15F97A41BB8B168E31745C5051
.bfmio.com/	1970-01-21 12:07:36	Name: __io_cid Value: 70946d5ac7c44b6f1b6f5f5cb668fe9de67a6149
.crwdcntrl.net/	1970-01-21 09:50:46	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 09:50:46	Name: _cc_id Value: f1b17054668096f62854a79d0e0d9f80
.ads.stickyadstv.com/	1970-01-21 04:05:12	Name: UID Value: 7ffad68241ab1a5acfcbcf09234317f
.ads.stickyadstv.com/	1970-01-21 03:23:26	Name: uid-bp-26865 Value: 3AAE8C15F97A41BB8B168E31745C5051
.lijit.com/	1970-01-21 12:07:36	Name: _ljtrtb_2 Value: 3AAE8C15F97A41BB8B168E31745C5051
.exelator.com/	1970-01-21 06:14:48	Name: ud Value: "eJxrXxzq6XKLQcHQ3DAtzTDF2DLR0DjRKDUpzczQNNUwxSw5ySLFwtDAcnFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDYeEl%252BUWb6otDgxUUpaQyLSopPBZ%252BavBAAsrkq2w%253D%253D"
.pippio.com/	1970-01-21 12:07:36	Name: did Value: CWyWyGMauzkdz-Sh
.pippio.com/	1970-01-21 12:07:36	Name: didts Value: 1740120433
.pippio.com/	1970-01-21 04:48:24	Name: nnls Value:
.pippio.com/	1970-01-21 04:48:24	Name: pxrc Value: CPHC4L0GEgYIgr0rEAA=
.fortinet.com/	1970-01-21 05:31:36	Name: _fbp Value: fb.1.1740120433711.934924463134719865
.doubleclick.net/	1970-01-21 04:05:12	Name: ar_debug Value: 1
.agkn.com/	1970-01-21 12:07:36	Name: u Value: C\|0AAAAAAAAL0rd8QAAAAAA
.analytics.yahoo.com/	1970-01-21 12:07:36	Name: IDSYNC Value: "176k~2nni:19ba~2nni"
.bidr.io/	1970-01-21 12:50:30	Name: bito Value: AADv3E7PcEMAABZyUs5i2Q
.bidr.io/	1970-01-21 12:50:30	Name: bitoIsSecure Value: ok
.pro-market.net/	1970-01-21 07:41:12	Name: anProfile Value: "18xpb1751qbrk+1+1f=1+1g=1+1j=57:1+rs=s+rt=2A04C604061500010000000000000006+s2=(ss0tip)+vm=24-3AAE8C15F97A41BB8B168E31745C5051:81-y-lXTqpV1E2pT8L6p35u0Otjhe3Z3YIBA8cjE-%7EA"
.mountain.com/	1970-01-21 12:07:36	Name: guid Value: af9c40e0-f01f-11ef-b18c-27d9a85f31e5
.px.mountain.com/	1970-01-21 12:07:36	Name: tt Value: "H4sIAAAAAAAAAKtW8guKNzYyNjaLNzK3NFayMtBRgnItjC2UrAzNTQwMjQxMjM0MzM10lMqUrIx0kLSA1RjUAgDC7SU7RgAAAA=="
.mountain.com/	1970-01-21 12:07:36	Name: rt Value: "MzIzMzY6MTc0MDEyMDQzNg=="
.adsrvr.org/	1970-01-21 12:07:36	Name: TDID Value: 038306c5-b09e-44f0-aa43-dec7ea9053d4
.adsrvr.org/	1970-01-21 12:07:36	Name: TDCPM Value: CAESEgoDYWFtEgsIlryuz7OT6T0QBRgFIAIoAjILCKaq6PnJk-k9EAU4AQ..

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant Message: [GroupMarkerNotSet(crbug.com/242999)!:A0400705343C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant Message: [GroupMarkerNotSet(crbug.com/242999)!:A0E05100343C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://api.omappapi.com/v2/embed/39852?d=fortinet.com Message: Failed to load resource: the server responded with a status of 401 ()
rendering	warning	URL: https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant Message: [GroupMarkerNotSet(crbug.com/242999)!:A0C0A900343C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://stags.bluekai.com/site/29931?id=3AAE8C15F97A41BB8B168E31745C5051 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10104846.fls.doubleclick.net
6033413.global.siteimproveanalytics.io
a.omappapi.com
a.opmnstr.com
aa.agkn.com
abm-tracking.demandscience.com
ad.doubleclick.net
ads.stickyadstv.com
amplify.outbrain.com
analytics.twitter.com
api.omappapi.com
api.schemaapp.com
assets.adobedtm.com
b.6sc.co
bam.nr-data.net
bat.bing.com
bcp.crwdcntrl.net
c.6sc.co
cdn.cookielaw.org
cdn.jsdelivr.net
cdn.schemaapp.com
ce.lijit.com
client-registry.mutinycdn.com
cm.everesttech.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
connect.facebook.net
d.agkn.com
data.schemaapp.com
dpm.demdex.net
dx.mountain.com
eb2.3lift.com
epsilon.6sense.com
fei.pro-market.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
i.simpli.fi
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
image2.pubmatic.com
insight.adsrvr.org
intentstream.contanuity.com
ipv6.6sc.co
j.6sc.co
js-agent.newrelic.com
loadm.exelator.com
match.adsrvr.org
metrics.fortinet.com
pbid.pro-market.net
pippio.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
px.ads.linkedin.com
px.mountain.com
px.steelhousemedia.com
px4.ads.linkedin.com
s.ad.smaato.net
script.crazyegg.com
secure.adnxs.com
simplifi.partners.tremorhub.com
siteimproveanalytics.com
snap.licdn.com
stags.bluekai.com
static.ads-twitter.com
sync.1rx.io
sync.bfmio.com
sync.intentiq.com
sync.outbrain.com
t.co
tag.simpli.fi
tags.inzynk.io
tags.srv.stackadapt.com
td.doubleclick.net
tr.outbrain.com
tracking.contanuity.com
tracking.crazyegg.com
trk.techtarget.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
wave.outbrain.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
ad.doubleclick.net
stags.bluekai.com
tracking.contanuity.com
104.19.147.8
104.21.16.1
104.244.42.3
107.178.254.65
108.138.128.83
13.107.42.14
142.250.80.102
142.251.40.130
142.251.40.164
142.251.40.166
142.251.40.194
142.251.40.200
142.251.41.2
146.75.32.157
15.197.193.217
151.101.1.91
162.159.140.229
162.247.243.29
2001:4998:14:800::1000
2001:4998:14:800::1001
207.65.37.184
216.200.232.253
23.34.59.33
23.41.169.82
2600:141b:f000:1e::1737:f346
2600:141b:f000:36::1728:129e
2600:141b:f000:c0b4::1e80
2600:1901:0:8eee::
2600:1f10:4ce4:4a05:565e:7dc2:ecda:d7b1
2600:1f18:1492:1702:852f:d87f:6683:b05a
2600:9000:21da:600:19:fc2c:a140:93a1
2600:9000:21da:fc00:1f:d9e6:d540:93a1
2600:9000:21f9:1200:12:dfa9:e200:93a1
2600:9000:23cb:3400:a:6e64:b280:93a1
2600:9000:2840:4a00:1b:5138:8a40:93a1
2600:9000:2840:8000:1b:6b7d:2300:93a1
2602:816:5001::39
2606:4700:4400::ac40:9b77
2606:4700::6812:1347
2606:4700::6812:309
2606:4700::6812:562a
2607:f8b0:4006:809::200e
2607:f8b0:4006:81e::2002
2607:f8b0:4006:820::2008
2620:1ec:21::14
2620:1ec:33::10
2a02:6ea0:c454::1
2a04:4e42:400::485
3.133.162.222
3.212.39.155
3.220.146.83
3.223.133.185
3.95.113.145
31.13.65.36
31.13.65.7
34.111.113.62
34.111.208.231
34.238.149.65
34.86.110.8
34.98.64.218
35.236.220.17
35.244.154.8
35.71.131.137
35.71.139.29
35.81.162.201
35.85.106.161
44.208.97.160
44.218.226.74
44.223.125.1
44.226.187.177
44.235.160.192
52.0.156.250
52.202.191.63
52.32.164.86
52.55.40.41
54.203.236.163
54.244.159.189
63.140.38.189
63.140.39.22
63.251.28.230
64.202.112.31
68.67.160.184
68.67.179.166
69.173.146.5
69.194.240.13
70.42.32.191
99.83.231.3
00faf2672d1c7fe5dd776ce57d1419d865fa5e057a3ec339c4cf6fbdd16a89f8
01d3c44791671916a95a17e3810a0bbb0817110f01c035d6e0faadcbcc581d2d
031efeac74277ec5268304403e9296483d4d7f8d47a2076021c33353c7079dd4
08a45557e96f2f1d5584a6287baaad19ddb6ccd9c807f6e88ba8a3bc55b8bbbc
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0ce943bce846991a9986a37aa4c13fdc877c65ae2cf691045c19a3143b60206e
0e79e0cf390976782043cdd0e4fb66661c9f7d61652a98524e3daeb57bfd8e7e
0ef8a857fb190698798842ca59adccf3a2bc47e56d46cd25c1faef2a68848f62
0f03d4ff929986a3cde83681fd2560eae544f7138f59945ec6ec32c17800ca91
10f2b3647f206dbf4eb3823804d50c9a5fd68b71001a8ecc1d72e6b377213a43
15fad644065e1a49aa9afade708793103edcb1223e9bf5b6456f7cfe8b0e50a6
16fb72ffe51980a00e52edf9a001b7d560b2bdbd1a56e04366a70b674204c359
1885fa140df271c97bf904d43f5385b84aa7458ff60cc20dae89ca4e9df959d9
18d9d050df7998e9bf7818ee86fe38893c4641d4e8f077ef6220b6b0ca0a4eaf
1960b031e24a73247b618959d145beb94ee0e9b52d6f0165fc852ff223f7ac9c
19aa1e382d440aef426bfd7685c967a0e9d027e85593815e2e156381e0d569c9
1cd95ff63f0b7859f52855a5b1f3d528b371186a8356e4bcae55b11e402a7a2b
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
1ebf4765c39e042319d8cc3f4070ef97c89b6e18a3f28bcec0bb7e58a9042a8f
1fdddb377d6442ed4a9ea71787b84b868c358163da4c5ecbdc55a65ea280a713
207cf18dd6b5c283f5c1f2ad622dbdf57b13426727b840de705a66405fc37ea4
21994b28ae9425b76c8a8dec4ad36df0a0f603c9a53db34dc74e59cf9a0639b7
2405c03999cdb1fda1c029c6b392718eac0e044dad46ec29a743941f20c63942
2466cad59509908859124f92c1d9a358117a2e9231859ab82c854d986af17510
26814e51f388a7fda526270be49fefb245a520cd056c10191cdca19da9b379bc
2863ff96543db6585df4b006edf7ce2f6eb15b4ba5fa99ebbf33e7ab64804129
291587250267a545dd5f4d7e6bcbda349c5eee0d7af6f1e41d18005753d614f4
29fb3e46f5797eb7705973e16d533228a814c942e5a87d1b577ab50ac9b05341
2a250e2f225e48cf583d54a0a42d623c700847de17323bf23ea372e5d9e89cb2
2bc6a125d698416498cdf5ef60cd959aef01db95a6e3e0d74a95f9b6d3d78feb
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a
339f8860aa2ba8e815c99e1e668b35af5d8ec7fde7901ca691a670f675b72976
33de96f9ee14b4c4b9362f9434a3938273241c6be5c8092b2a29e2bbed8d4a08
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
483bd926e0154420ffcb610d6461cabaeefe68c613fe7819b748474f1f5646a4
48db9ee3ec5953cd412bed3604a6820b72a73b9fa63aa5558744470f36d8361f
4b0a6a5f0ee45c837fcd1a12a51effd4d94cacc135ce756d51a5709d9ca6ec78
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4da8a6638ad70698ad3d01aa0ef124aebe35c297685c0796b174822f597b1d09
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4ffd3657286299a5561ddebfac6d9c15e3d0154f7a564cf792de1156c9666fae
50dfcc07e51f99ff7853a87bbb34e3c1dd7eba92f2f4b344882e317a01d39f42
50f889884d03bda56ac0292382b170c0d46271fc60abcb33a12d8ac42177cbb1
56b4e46029065aa102f2c2adbfb169ec47250dacb6dc1e18245338829a892309
59b3bd516133fe0205b749b48d7472907a885938f7f46e08450349cd2ff808c6
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5cfc692b4a80789116136fc18a20797f18ca8c5af104eba055490e52ff49e0f5
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
6026017670c2e2b0acf75588310ea4a83f66376178856a794da73e95d2f86625
60508fca4a54390790c68f6ec949502d38dbf037230c8e5cfa972b134d68a24c
63a5dec586bfaa3fb7a65faccfda77c43d0c1144f6e517f01ae36a3b4198edb6
64c149abf4d0b26539446abeb0ba4c5e8180ca0f55b812f8b822812a23e0cb29
66a04863f707aa396e0cc70d0b8aaca97f1051642c17fdbcfaf0148ef9dd046c
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
69af3fb7713773cdb9bdfff9bbcca4ffcf6a948b0dae39561b16a025328c5aaa
6ab8cec21d24650e7daff4c1b478cd643158968caec50be8f44571eed95d130b
6ba6d1b450a99dde0fa8110122c9202d4661d922f2a3e82a757333e2fa71c185
6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552
6d99c0d5a4651725b742a9c6d661473c568f48179c805c7fb5c13b2f4ce99653
7195552bcda2596ebd8766f1a3495fed0e3b70ecb2d6f62ff0a3277bfce36d00
757a98f8bb846f157be017fa73ac1b103d4f8a71b07bfeae6506690a557c2adf
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
7b1e74dd6970b56853dfd79e59ba73315051b0c59a69c6a9fd87e515650fdc80
7db8d077fc21c20f1449a2603d524e423cfa25d7df6d5fd845a8e5e883aa227e
7db94f3e110167f120a53a011f1b10ebd1ed9f846ca4e941adc0d3f45bcaa3ad
7f02b91b05ef460439ea413a097e19ff7c42187afb94276355ccccf77d4a356c
80cc6f6a35ae700a714f5dd4104469247c6a2c06c6abfc7a32f9714f819829cd
82e794cc9f94fc996f16011f455a25e63136aec4d959eda35fce76b6fcf209ff
8446bedaded69d8ebd347bf1653a1bacfc07325d08c89a09f253af9df95175fe
8a778662df7a850ea1cd82287736d893311caeb3cb7652fb33e4b2c6f5a160ee
8c7763d7ca20026303e95458b1c4f9c7bfddb2fb6765cf058df50109fa0553ce
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
9111932368e8635721db2225b3b23fa38cff5b8e639ee64ac1ca3e1439b15ccb
9398c7190476b7b930d63f828ff450861f10b85dac2b21dc20d7ed8133490d04
941ced91edfdd239bfc8a27902822a1ef74592f4b975701656f1792e3fdb192a
98192c2b3bfd0e66cff07b8ba31ff42de9182144d3e21b9ca258f13da96ee457
99ae400fd871a6829ad0549d8f80ac7c3f0c7efd039856f2b97edea300f1c07c
99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae
9b47b08789f1d9916efd9bde720f8228117959676a35b78b10f89a3bea82cfa4
9ceceb1fbc22685946d85befd074085b6b4fded0f6ac2ad22912e2cce0152439
9f72a396c065f740bdbd9b194c9533caf1c670c733bb111053e745c6c7b91b97
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2178f28d4a30172146fcc241322eb2b2fa8b7304edc707ff49d67dfcf81db26
a2d72803f86e55b4de83d3f30f408f05897f29787f5a9cce5994402b74790b11
a3c5d7ffd7033b7824d528a186332cd8cd897f2c18947b4392a96fe566cfd5dc
a41d192fd18c2f7cdbd088af95a56af9dee5b261ac9be6210bd0f922d19ec5ba
a65f1137792645c10ccfc78877b207bc86f078e820487eecc34e9c28c9ee86b5
a88c22cdf0f3c7434c98426d5b493aa7cf3f6d3757e350d13a440ec6d7982185
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ac6aec96f603d832d19c5d20bf3ddf80be707441e0457bed6507af1b80bb6e28
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae2d41b50d412a6c82e2046834f185d5e189d7d870f1440283dceccc8f88f5cd
af74dae031b06dadee5dfe551cc71e4a6789abe5d36873dc9e7f753cef27fc8b
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2103a4f9f9282f68c2e6e5a56c449f2922be99270fa9910d19098b93afe2d26
b22a895efde249e663db1f645f4e9cc1a6066bded058e4365e2b7c070d956f4f
b3f00dd807bc8453c695bfd454c55d8484da58f51d38d29175cdae892644879c
b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553
b7a4e6b125b5b2e072e039af07fcd01e083e02c8cd2163345befd230295c4fcb
b7ed027ef1dada70383fb3537e124725d2091fadc7d7ef07cbb3a0960fd24d2c
b8456dc3fa1b21befbd118255798b93dce7d488a1c4c2380de4e6cb7a5866d83
b8ea1ecff9e21aef9388ba3961835b44ecd42defa908bb63658ba1cd5634f7da
b934ce9883949e7bceb88fa78a354125eefc85715f7e54da8ff529c94ebab0fe
b952a18083af097956c11f4792853b10907433ab4013dcee46e580953c2564c1
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c0b4a76926bdb1cd2207319f82aa00def513ba7d0cbaf57ea4a21b64866f0869
c6bcc71f8a9f5497ccc35e3aa16e00110504488fef71fffea99853274f9d7c86
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cce2184ec089babc70ded47b8474c543f6a5ff013e4bfd9dbae8689489bb13ba
cdb64d1b6efbcd95d0708bc6e0b827c71841feddf6da1454f2f0e839e1c1c48c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60
d49f0a8a5c37321b5ebac98914454e104f124b51ba68005df2b2ee202f50e488
dacba039f33e6915437e5174c1eac36f65a037c17d5454b1f5bb27098aaa36e2
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ddcc5821fd0d67a7ceb666e87f4ece0885bf44371526388d8f1b0d0fd2ea87d9
df54c069da584ec929d42161c8fd19e74c7f408d70e6e7e0f8d27cc9c02a0ad9
dfe4299abe67b328635794581230b980af9c961749f00ad767376821afc90888
e0488b186e4c346fa8984b89d4967f1ec74b1c5e4b08e001b0da1d54fcde0d57
e1132f3948b84a67d82e91f47f44d9d8dbbbe4b8c86bcbcf1c0774bb73ccfbc0
e197b66f21e74786f91206df05a7e76f5a731b883d00a42258ba9f009150544c
e1fdc57bdb7295c9178d55076cd31466a661113cd89febcf10a2baa0e0dd5f27
e24a2a96c46d1401811a57e213516c02a46ff72f8a46210e8d08c4b40ef36691
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea59b04200b193261e6d40c283fece2bdb18157129e0c93843c9fa69d1819827
ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0
ea813adb4e66ed6ca1abd17238f0198bee303204f37b2fde119e59658e6c9be0
eb1b3be7bee349ce6a0b001c05bc33766882f39784ee87bf0f247557158cd793
edf61f5e80302ecb8585243b41cc158f5bfc5d0cde2b606f693a8b269ba8e4b4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4810c749b515a37bd4e8639dd9d7d1289dd21aaf990774e0a1e31a8e4911158
f576d437b5a019f913f469aed109dfd84ddf97264921fca41149916d3898435c
f59e6a6cabc4d8d4e5cb4159b47fc999f0efe4b4a37fd60a31803547e1f51c03
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.fortinet.com Open in urlscan Pro 2600:1f18:1492:1702:852f:d87f:6683:b05a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

232 Requests

87 %HTTPS

30 %IPv6

64 Domains

93 Subdomains

77 IPs

2 Countries

3055 kBTransfer

8230 kBSize

117 Cookies

10 Outgoing links

Redirected requests

232 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fortinet.com Open in urlscan Pro
2600:1f18:1492:1702:852f:d87f:6683:b05a Public Scan

Screenshot
Live screenshot

Full Image

232
Requests

87 %
HTTPS

30 %
IPv6

64
Domains

93
Subdomains

77
IPs

2
Countries

3055 kB
Transfer

8230 kB
Size

117
Cookies

232 HTTP transactions
2 data transactions