urlscan.io logo urlscan.io
SecurityTrails logo

www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f67d  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Submission: On June 06 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 17 IPs in 3 countries across 14 domains to perform 58 HTTP transactions. The main IP is 2606:4700:300b::a29f:f67d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.fireeye.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 7th 2021. Valid for: a year.
This is the only time www.fireeye.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
20 2606:4700:300... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 151.101.13.181 54113 (FASTLY)
1 1 104.109.88.248 16625 (AKAMAI-AS)
2 13.108.251.135 14340 (SALESFORCE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
3 13.32.25.36 16509 (AMAZON-02)
1 52.51.251.137 16509 (AMAZON-02)
12 54.84.172.129 14618 (AMAZON-AES)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 13.110.44.53 14340 (SALESFORCE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 130.211.29.114 15169 (GOOGLE)
2 52.204.168.112 14618 (AMAZON-AES)
4 35.241.15.240 15169 (GOOGLE)
58 17
20    2606:4700:300b::a29f:f67d (United States)

ASN13335 (CLOUDFLARENET, US)
www.fireeye.com
1    2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googleoptimize.com
1    151.101.13.181 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
play.vidyard.com
1    104.109.88.248 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-88-248.deploy.static.akamaitechnologies.com
cloud.typography.com
2    13.108.251.135 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl8-ord.la1-c2-ord.salesforceliveagent.com
c.la2c2.salesforceliveagent.com
d.la2c2.salesforceliveagent.com
1    2606:4700::6810:252f (United States)

ASN13335 (CLOUDFLARENET, US)
js.maxmind.com
3    2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
3    13.32.25.36 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-25-36.fra56.r.cloudfront.net
app.cdn.lookbookhq.com
1    52.51.251.137 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-251-137.eu-west-1.compute.amazonaws.com
fireeye.tt.omtrdc.net
12    54.84.172.129 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-84-172-129.compute-1.amazonaws.com
jukebox.pathfactory.com
2    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    13.110.44.53 (Dublin, United States)

ASN14340 (SALESFORCE, US)
PTR: dcl13-ncg1-c6-iad5.la1-c1-ia5.salesforceliveagent.com
d.la1-c1-ia5.salesforceliveagent.com
1    2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    130.211.29.114 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 114.29.211.130.bc.googleusercontent.com
cdn.perfdrive.com
2    52.204.168.112 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-168-112.compute-1.amazonaws.com
spcollector.pathfactory.com
4    35.241.15.240 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 240.15.241.35.bc.googleusercontent.com
cas.avalon.perfdrive.com
Domain Requested by
20 www.fireeye.com www.fireeye.com
12 jukebox.pathfactory.com www.fireeye.com
4 cas.avalon.perfdrive.com www.fireeye.com
3 app.cdn.lookbookhq.com www.fireeye.com
3 www.googletagmanager.com www.fireeye.com
www.googletagmanager.com
2 spcollector.pathfactory.com www.fireeye.com
2 cdn.perfdrive.com www.fireeye.com
2 maxcdn.bootstrapcdn.com www.fireeye.com
maxcdn.bootstrapcdn.com
1 cdnjs.cloudflare.com www.fireeye.com
1 d.la1-c1-ia5.salesforceliveagent.com www.fireeye.com
1 fonts.googleapis.com www.fireeye.com
1 fireeye.tt.omtrdc.net www.fireeye.com
1 d.la2c2.salesforceliveagent.com www.fireeye.com
1 js.maxmind.com www.fireeye.com
1 c.la2c2.salesforceliveagent.com www.fireeye.com
1 cloud.typography.com 1 redirects
1 play.vidyard.com www.fireeye.com
1 www.googleoptimize.com www.fireeye.com
58 18
Subject Issuer Validity Valid
fireeye.com
Cloudflare Inc ECC CA-3		 2021-01-07 -
2022-01-06		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-05-10 -
2021-08-02		 3 months crt.sh
*.vidyard.com
GlobalSign Atlas R3 DV TLS CA 2020		 2021-03-22 -
2022-04-23		 a year crt.sh
la1-c2-ord.salesforceliveagent.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-04-26 -
2022-04-25		 a year crt.sh
*.maxmind.com
Sectigo RSA Organization Validation Secure Server CA		 2020-10-07 -
2021-11-06		 a year crt.sh
cdn.lookbookhq.com
Amazon		 2020-11-08 -
2021-12-07		 a year crt.sh
*.tt.omtrdc.net
DigiCert SHA2 Secure Server CA		 2020-11-02 -
2021-11-09		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-03-01 -
2022-02-28		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2021-05-10 -
2021-08-02		 3 months crt.sh
*.pathfactory.com
Amazon		 2021-03-22 -
2022-04-20		 a year crt.sh
la1-c1-ia5.salesforceliveagent.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-04-07 -
2022-04-06		 a year crt.sh
*.perfdrive.com
Go Daddy Secure Certificate Authority - G2		 2020-09-15 -
2021-09-26		 a year crt.sh
cas.avalon.perfdrive.com
Go Daddy Secure Certificate Authority - G2		 2020-07-30 -
2021-08-05		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Frame ID: F673872207D2B8B094E1659598C3DB46
Requests: 58 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/etc\/designs\//i
  • script /\/etc.clientlibs\//i
Overall confidence: 100%
Detected patterns
  • script /\/etc\/designs\//i
  • script /\/etc.clientlibs\//i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

58
Requests

98 %
HTTPS

41 %
IPv6

14
Domains

18
Subdomains

17
IPs

3
Countries

1512 kB
Transfer

3608 kB
Size

8
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://cloud.typography.com/6746836/6977592/css/fonts.css HTTP 302
  • https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/E164E390493CD4814.css

58 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request evasive-attacker-leverages-solarwinds-supply-chai
www.fireeye.com/blog/threat-research/2020/12/ 		62 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9fc8ac38f385b6c62ebf86e5b9ac919132fea415d587e42b62766e7217fb404f
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.fireeye.com
:scheme
https
:path
/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:41:45 GMT
content-type
text/html; charset=UTF-8
cf-ray
65afa81e89470eb3-FRA
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding,User-Agent
cf-cache-status
DYNAMIC
cf-request-id
0a81a7671400000eb3609eb000000001
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-content-type-options
nosniff
x-dispatcher
dispatcher1uswest1
x-frame-options
ALLOW-FROM https://content.fireeye.com
x-vhost
publish
x-xss-protection
1; mode=block
server
cloudflare
content-encoding
gzip
optimize.js
www.googleoptimize.com/ 		504 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleoptimize.com/optimize.js?id=GTM-MDPBTTG
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
013668227d3e7edac274e479349fa3040b52816e5a30fe3eb36465118c635146
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
60791
x-xss-protection
0
expires
Sun, 06 Jun 2021 06:41:45 GMT
jquery.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 		111 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/jquery.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3718
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
38305
cf-request-id
0a81a76aff00000eb379bee000000001
last-modified
Sun, 06 Jun 2021 02:43:40 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"1baa2-5c40fe480bcd3-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa824ccb70eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
csrf.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
2824
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1676
cf-request-id
0a81a76b0100000eb36a108000000001
last-modified
Sun, 06 Jun 2021 02:42:48 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"f3e-5c40fe1611965-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa824ccbf0eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
clientlibs_nav.min.js
www.fireeye.com/etc/designs/fireeye-www/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_nav.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc/designs/fireeye-www/clientlibs_nav.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
2824
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
3882
cf-request-id
0a81a76b0200000eb39aaff000000001
last-modified
Sun, 06 Jun 2021 02:44:14 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"2f77-5c40fe67e2f0c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa824ccc10eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
api.js
play.vidyard.com/v0/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://play.vidyard.com/v0/api.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.181 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6980eadbd6f6d6233ea9b987e9ae462b25726871e9797c51e0d550aef3cc861d
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:41:45 GMT
via
1.1 varnish
vary
X-ThumbnailAB, X-China, accept-language, Accept-Encoding
age
1522
x-cache
HIT
content-encoding
gzip
content-length
7168
x-served-by
cache-fra19132-FRA
x-china
0
last-modified
Fri, 30 Apr 2021 19:42:10 GMT
x-timer
S1622961706.769876,VS0,VE1
etag
"7b874dd3eb596697c6d49ba7ed6880f8"
strict-transport-security
max-age=300
content-type
application/javascript
accept-ranges
bytes
x-cache-hits
1
E164E390493CD4814.css
www.fireeye.com/content/dam/fireeye-www/fw/f/775489/
Redirect Chain
  • https://cloud.typography.com/6746836/6977592/css/fonts.css
  • https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/E164E390493CD4814.css
473 KB
356 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/E164E390493CD4814.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4c67fe8115b40f60d96ecd24873ba492cfdc4d876d1368c1c1142237f56292a
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/content/dam/fireeye-www/fw/f/775489/E164E390493CD4814.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.fireeye.com
referer
https://www.fireeye.com/
:scheme
https
sec-fetch-site
cross-site
:method
GET
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
33823
cf-polished
origSize=485384
x-vhost
publish
cf-bgj
minify
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
last-modified
Sat, 05 Jun 2021 02:27:54 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
W/"76808-5c3fb8e446f76-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id
0a81a7705500000eb35a1c9000000001
cf-ray
65afa82d5c9f0eb3-FRA
expires
Mon, 14 Jun 2021 06:41:47 GMT

Redirect headers

Date
Sun, 06 Jun 2021 06:41:47 GMT
Last-Modified
Wed, 01 Apr 2020 20:12:09 GMT
Server
AkamaiNetStorage
ETag
"d0795af83d79e23ccaffb60b4a75e364:1608661510.648217"
Content-Type
text/html
Location
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/E164E390493CD4814.css
Cache-Control
must-revalidate, private
Connection
keep-alive
X-HCo-pid
16
Content-Length
154
Expires
Sun, 06 June 2021 06:41:46 GMT
patch.css
www.fireeye.com/content/dam/fireeye-www/fw/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/css/patch.css?v=1
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d78bfcf1f62b6a4a6c403372ad3a4f46fcf2bda72822ae206129d38de72f4d84
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/content/dam/fireeye-www/fw/css/patch.css?v=1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
41586
cf-polished
origSize=6112
x-vhost
publish
cf-bgj
minify
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
last-modified
Fri, 18 Dec 2020 19:29:31 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id
0a81a76b0000000eb374a84000000001
cf-ray
65afa824ccba0eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
clientlibs_fw-2019.min.css
www.fireeye.com/etc/designs/fireeye-www/ 		211 KB
41 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
985a53bcdeef61498d5d62a66f67a440ae441de38cced2a9cfbc8bd6b029da58
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
40112
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
41599
cf-request-id
0a81a76b0000000eb35ebbe000000001
last-modified
Sat, 05 Jun 2021 02:11:52 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"34cc2-5c3fb54f35ae3-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa824ccbd0eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
utils.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/utils.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
11638
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
3706
cf-request-id
0a81a76b0200000eb35d21c000000001
last-modified
Sun, 06 Jun 2021 02:42:48 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"26ad-5c40fe160f255-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa824ccc40eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
granite.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
11638
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1702
cf-request-id
0a81a76b0200000eb352359000000001
last-modified
Sun, 06 Jun 2021 02:42:09 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"f90-5c40fdf0c4bd8-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa824ccc60eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
jquery.min.js
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 		16 B
241 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/jquery.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/foundation/clientlibs/jquery.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
11638
x-vhost
publish
vary
User-Agent, Accept-Encoding
content-length
16
cf-request-id
0a81a76b0200000eb395ad2000000001
last-modified
Sun, 06 Jun 2021 02:43:59 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"10-5c40fe5a14929"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa824ccc80eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
shared.min.js
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 		24 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/shared.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/foundation/clientlibs/shared.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
11638
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
6920
cf-request-id
0a81a76b0300000eb3481e6000000001
last-modified
Sun, 06 Jun 2021 02:44:14 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"5e7e-5c40fe6804a1c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa824ccc90eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
modern.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/ 		34 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/modern.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/lodash/modern.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
11638
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
11784
cf-request-id
0a81a76b0300000eb368bc9000000001
last-modified
Sun, 06 Jun 2021 02:43:59 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"87c8-5c40fe5a26168-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa824ccca0eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
kernel.min.js
www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/ 		119 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/kernel.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/cq/personalization/clientlib/personalization/kernel.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Sun, 06 Jun 2021 06:41:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
11638
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
26194
cf-request-id
0a81a76b0300000eb367830000000001
last-modified
Sun, 06 Jun 2021 02:43:59 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"1dd96-5c40fe5a16c51-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa824ccce0eb3-FRA
expires
Mon, 14 Jun 2021 06:41:45 GMT
deployment.js
c.la2c2.salesforceliveagent.com/content/g/js/34.0/ 		41 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.la2c2.salesforceliveagent.com/content/g/js/34.0/deployment.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.108.251.135 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl8-ord.la1-c2-ord.salesforceliveagent.com
Software
Jetty /
Resource Hash
9499be67341dbf440da185e39df07aca421bfcb879634777989e415b4b87b77c

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 06 Jun 2021 06:41:46 GMT
Cache-Control
max-age=60, must-revalidate
Last-Modified
Wed, 02 Jun 2021 22:03:44 GMT
Server
Jetty
Accept-Ranges
bytes
Content-Length
41567
Content-Type
application/javascript
fe-logo-color.svg
www.fireeye.com/content/dam/fireeye-www/fw/images/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/images/fe-logo-color.svg
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/content/dam/fireeye-www/fw/images/fe-logo-color.svg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
37625
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1239
cf-request-id
0a81a76f0700000eb36880d000000001
last-modified
Sat, 05 Jun 2021 02:12:17 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"cec-5c3fb5664aa0c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/svg+xml
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa82b390b0eb3-FRA
expires
Mon, 14 Jun 2021 06:41:46 GMT
clientlibs_fw.min.js
www.fireeye.com/etc/designs/fireeye-www/ 		165 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b82c98e8c4f4a5c771ef6f061634b0fe49da9f53f915cdf0f576b1cf655db0c1
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc/designs/fireeye-www/clientlibs_fw.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3719
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
50685
cf-request-id
0a81a76ee100000eb367296000000001
last-modified
Sun, 06 Jun 2021 02:44:24 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"29217-5c40fe71ae838-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa82af8880eb3-FRA
expires
Mon, 14 Jun 2021 06:41:46 GMT
token.json
www.fireeye.com/libs/granite/csrf/ 		2 B
195 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/libs/granite/csrf/token.json
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/libs/granite/csrf/token.json
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
empty
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Sun, 06 Jun 2021 06:41:46 GMT
x-content-type-options
nosniff nosniff
cf-cache-status
DYNAMIC
x-vhost
publish
vary
User-Agent, Accept-Encoding
content-length
2
cf-request-id
0a81a76b6700000eb35f152000000001
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/json;charset=iso-8859-1
x-xss-protection
1; mode=block
cache-control
no-cache
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray
65afa8256dd80eb3-FRA
expires
-1
me
js.maxmind.com/geoip/v2.1/country/ 		771 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:252f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f68265c1dfaee5e2034c2ec57e915052c236066259aec53ed35d489f841cecd

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:41:45 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin
*
cf-ray
65afa82598cf4de8-FRA
content-length
771
cf-request-id
0a81a76b8000004de8f3027000000001
gtm.js
www.googletagmanager.com/ 		315 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
40b7a7f18324515f5e7f8680cef0afccbf0572bc9bea3dd67c9a50083c085676
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:41:47 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
98805
x-xss-protection
0
last-modified
Sun, 06 Jun 2021 06:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 06 Jun 2021 06:41:47 GMT
truncated
/ 		28 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb854d12c9f15b7e02f12ed4f774638aba6640d5f6f13a3bfa425dbbf0b745f3

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
fireicons.woff
www.fireeye.com/content/dam/fireeye-www/fw/f/ 		72 KB
37 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rk
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85b6f75f021535da621a7a7f0974ef384720048e32aba9b217d1252329a287a3
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rk
pragma
no-cache
origin
https://www.fireeye.com
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
font
:authority
www.fireeye.com
referer
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://www.fireeye.com
Referer
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Sun, 06 Jun 2021 06:41:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
32224
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
36869
cf-request-id
0a81a770aa00000eb37985f000000001
last-modified
Thu, 27 May 2021 20:35:09 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-font-woff
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa82ddd6a0eb3-FRA
expires
Mon, 14 Jun 2021 06:41:47 GMT
truncated
/ 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c9b7d6e7a5672d872763ce1eee54e278c0e2294e4bdb23ba19120e50a757a02b

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/ 		28 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fb384da9d5c974e03adbec0785369381df8f2c656d21faf6d9e10c96612ff14b

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/ 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
93144b711b7ef4bed3c9b9d28983347edf6d70d2290911886f13467d6cabc911

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
716384b3b8c4f5d4e8d89c23b9a4f9516d78f82b6060ae89c493697d7f20f16c

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
bg-language-select.jpg
www.fireeye.com/content/dam/fireeye-www/fw/images/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/images/bg-language-select.jpg
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fabf3e1b3923a5f61dcd7d00070c259de08fc9dff32214ea1957e98741ace714
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/content/dam/fireeye-www/fw/images/bg-language-select.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:47 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
9865
cf-polished
degrade=85, origSize=9453
x-vhost
publish
cf-bgj
imgq:85,h2pri
vary
Accept-Encoding
content-length
7182
x-xss-protection
1; mode=block
last-modified
Sun, 06 Jun 2021 02:59:06 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"24ed-5c4101bae025c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/jpeg
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id
0a81a7711900000eb3539cb000000001
accept-ranges
bytes
cf-ray
65afa82e8ea80eb3-FRA
expires
Mon, 14 Jun 2021 06:41:47 GMT
segmentation.segment.js
www.fireeye.com/etc/ 		0
145 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc/segmentation.segment.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc/segmentation.segment.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
cache-control
no-cache
sec-fetch-dest
empty
:authority
www.fireeye.com
x-requested-with
XMLHttpRequest
:scheme
https
sec-fetch-site
same-origin
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:method
GET
Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Sun, 06 Jun 2021 06:41:47 GMT
x-content-type-options
nosniff nosniff
cf-cache-status
MISS
x-vhost
publish
vary
User-Agent, Accept-Encoding
content-length
0
cf-request-id
0a81a7711a00000eb39da33000000001
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"d41d8cd98f00b204e9800998ecf8427e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-javascript
x-xss-protection
1; mode=block
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
65afa82e8ec70eb3-FRA
expires
Mon, 14 Jun 2021 06:41:47 GMT
stores.init.js
www.fireeye.com/etc/clientcontext/default/content/jcr:content/ 		3 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.fireeye.com/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fsite-content%2Fen_US%2Ferror_404&_=1622961705827
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
529175b098022074edb4d452b04cccd41edc11cc7381036de99d8a173c6c07c1
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

:path
/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fsite-content%2Fen_US%2Ferror_404&_=1622961705827
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
cache-control
no-cache
sec-fetch-dest
empty
:authority
www.fireeye.com
x-requested-with
XMLHttpRequest
:scheme
https
sec-fetch-site
same-origin
referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
:method
GET
Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:41:47 GMT
content-encoding
gzip
vary
Accept-Encoding
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
65afa82e9ed70eb3-FRA
cf-request-id
0a81a7711c00000eb377368000000001
expires
Thu, 01 Jan 1970 00:00:01 GMT
MultiNoun.jsonp
d.la2c2.salesforceliveagent.com/chat/rest/System/ 		226 B
589 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.la2c2.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.108.251.135 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl8-ord.la1-c2-ord.salesforceliveagent.com
Software
/
Resource Hash
c547279d92c72f80e6c580e39599f11d50c552d9cb296adb8eb11938329384fc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Expires
-1
truncated
/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
295cc2973fd8e0ea98700592bf1c04cec651e78313d891e5047cf4e46d2aa667

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c5d851f82aed40520103262006a2c0fd15a861db9d478f3befc4184a6ee67279

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4945b7b3e791e1d8813c97e2df9d392a99b977362b5c6e4dc24e47851357d7bf

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
jukebox.js
app.cdn.lookbookhq.com/production/jukebox/current/ 		760 KB
210 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.25.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-25-36.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
95fa088f5d480c65fd4e9797ed6042763bce8cbd4f092374b28512daeda3a817

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
null
content-encoding
gzip
last-modified
Thu, 27 May 2021 04:51:12 GMT
server
AmazonS3
age
6626
etag
W/"f70fcbb519239918bdea5f540a74a59a"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
via
1.1 1ee1abe42f3acbda66e5d1252319566a.cloudfront.net (CloudFront)
cache-control
max-age=43200
date
Sun, 06 Jun 2021 04:51:23 GMT
x-amz-cf-pop
FRA56-C2
x-amz-cf-id
L3VDLUg6tRnbneYi8vYsOhJgCbK4EOv4qNjvpOV4GMiGTyetnS32jQ==
js
www.googletagmanager.com/gtag/ 		82 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-10870294
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
847388df8e014402de6e05a34fc2e9e23f937d8eba2fd20d81714d1b678e13e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:41:47 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33665
x-xss-protection
0
last-modified
Sun, 06 Jun 2021 06:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 06 Jun 2021 06:41:47 GMT
json
fireeye.tt.omtrdc.net/m2/fireeye/mbox/ 		96 B
397 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fireeye.tt.omtrdc.net/m2/fireeye/mbox/json?mbox=target-global-mbox&mboxSession=1710b773b757408ab6f6e27445bbf41b&mboxPC=&mboxPage=281fceda59294fef8f96d4b9ee3ad504&mboxRid=5c1f6bbbce6e42d883a297effcbb4f44&mboxVersion=1.7.1&mboxCount=1&mboxTime=1622968907379&mboxHost=www.fireeye.com&mboxURL=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.51.251.137 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-51-251-137.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
80a1ddbfe525409a87ab1ef6e8ba9c24dfd19bc1607b455633f9e291da08ba9b

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 06 Jun 2021 06:41:47 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.fireeye.com
cache-control
no-cache
access-control-allow-credentials
true
timing-allow-origin
*
content-length
96
x-request-id
5c1f6bbbce6e42d883a297effcbb4f44
v1.js
www.googletagmanager.com/dclk/ns/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/dclk/ns/v1.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10870294
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
03bef1eeac54d221d1da744095e12a9caae78fb47a16f0d9a7598fa83cd79fcf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 02 Jun 2021 02:46:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
age
359745
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1094
x-xss-protection
0
expires
Wed, 09 Jun 2021 02:46:02 GMT
website_experience
jukebox.pathfactory.com/api/public/v1/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=10bf9775-2b61-4bd3-bbb2-4fe8973f6855&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 06 Jun 2021 06:41:47 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
website_forms
jukebox.pathfactory.com/api/public/v1/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-9AC90F09-10427&visitorUuid=10bf9775-2b61-4bd3-bbb2-4fe8973f6855&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 06 Jun 2021 06:41:47 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 		28 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:41:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
632, 617
age
6513928
cdn-cachedat
2021-03-11 11:58:15
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a81a772030000c2f9f186a000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
a754e168c4f0fb62e4072354b1d05890
cf-ray
65afa8300e5dc2f9-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
css
fonts.googleapis.com/ 		4 KB
714 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,700
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f7bba0cc484923e9dc8eb46a451efbd2ebe40980e07195777adaa39956bc5cd5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 06 Jun 2021 05:25:00 GMT
server
ESF
date
Sun, 06 Jun 2021 06:41:47 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 06 Jun 2021 06:41:47 GMT
website_experience
jukebox.pathfactory.com/api/public/v1/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=10bf9775-2b61-4bd3-bbb2-4fe8973f6855&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash
7c83a52f87765199c12bbac30e2fee7fd3cc20cabf91370b488889373d7a9375
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 06 Jun 2021 06:41:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin, Accept-Encoding
x-request-id
1c836d08-a989-45c9-bad8-98670829c75d
x-runtime
0.060968
referrer-policy
no-referrer-when-downgrade
etag
W/"7c83a52f87765199c12bbac30e2fee7f"
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
website_forms
jukebox.pathfactory.com/api/public/v1/ 		0
412 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-9AC90F09-10427&visitorUuid=10bf9775-2b61-4bd3-bbb2-4fe8973f6855&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

x-runtime
0.012232
date
Sun, 06 Jun 2021 06:41:48 GMT
referrer-policy
no-referrer-when-downgrade
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
no-cache
access-control-allow-credentials
true
vary
Origin
x-content-type-options
nosniff
x-request-id
e8d2670e-a0ab-4314-b471-f69da075e546
init
jukebox.pathfactory.com/api/public/v1/ 		354 B
861 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-9AC90F09-10427&image=&title=&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash
ddeec9dced8be575598e18285dac68896a44a1a39645c772ec6bebd284384067
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 06 Jun 2021 06:41:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin, Accept-Encoding
x-request-id
97de0309-3295-4610-95d3-01431ce94f15
x-runtime
0.014202
referrer-policy
no-referrer-when-downgrade
etag
W/"ddeec9dced8be575598e18285dac6889"
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
init
jukebox.pathfactory.com/api/public/v1/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-9AC90F09-10427&image=&title=&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 06 Jun 2021 06:41:47 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
MultiNoun.jsonp
d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/ 		496 B
758 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.110.44.53 Dublin, United States, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl13-ncg1-c6-iad5.la1-c1-ia5.salesforceliveagent.com
Software
/
Resource Hash
57579cbd5bc12cfa9522f8535c8e90a49998f026dc487cdeebca731110cf4104
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Expires
-1
recommendations
jukebox.pathfactory.com/api/public/v1/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/api/public/v1/recommendations?clientId=LB-9AC90F09-10427&sourceType=2&visitorUuid=10bf9775-2b61-4bd3-bbb2-4fe8973f6855&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai&contentPoolId=2ca285d7-8aca-463c-ac25-1b615d9c2519&appearanceId=1014&recommendationType=trending
Protocol
H2
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 06 Jun 2021 06:41:48 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
sp.min.js
cdnjs.cloudflare.com/ajax/libs/snowplow/2.17.3/ 		76 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/snowplow/2.17.3/sp.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a876a773b46aea97d22c1f84dac918fbc98ee3c1e1729f21cef7911de52f141e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:41:48 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4716648
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
22932
cf-request-id
0a81a774bb0000061ce2812000000001
timing-allow-origin
*
last-modified
Tue, 16 Feb 2021 22:52:47 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"602c4cbf-12eb9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=79Y3b7uHT%2BB2TpcAo8kHi8OVkFTbbMeVHX59zQ5Uw%2B5B0v9tKlTE9m53oOeKRaZd%2Bo%2BmRl2fBPk%2Btg2G4W%2FdjctHxfJF%2B%2FoyE3HOogymKFY%2FUC5%2FpDuGhgHl0n%2B8zcsKi5vXM4huGWiKAdXp7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
65afa8345a46061c-FRA
expires
Fri, 27 May 2022 06:41:48 GMT
xray.js
cdn.perfdrive.com/aperture/ 		2 KB
1002 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.perfdrive.com/aperture/xray.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.29.114 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
114.29.211.130.bc.googleusercontent.com
Software
nginx/1.10.1 /
Resource Hash
43589ba59da28a72ed7a6f7d2c56b83cd1b2466a9520f9848517935089405a56

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:00:02 GMT
content-encoding
gzip
last-modified
Tue, 11 May 2021 04:49:40 GMT
server
nginx/1.10.1
age
2506
etag
W/"609a0ce4-861"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600,public
alt-svc
clear
content-length
820
via
1.1 google
aperture.js
cdn.perfdrive.com/aperture/ 		44 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.perfdrive.com/aperture/aperture.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.29.114 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
114.29.211.130.bc.googleusercontent.com
Software
nginx/1.10.1 /
Resource Hash
1ef89c6057c63e1fd2bda3054817b95cb244d353dc1dafd2736e0ad49ca97924

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:26:15 GMT
content-encoding
gzip
last-modified
Tue, 11 May 2021 04:49:39 GMT
server
nginx/1.10.1
age
933
etag
W/"609a0ce3-ae3a"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600,public
alt-svc
clear
content-length
13453
via
1.1 google
recommendations
jukebox.pathfactory.com/api/public/v1/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/api/public/v1/recommendations?clientId=LB-9AC90F09-10427&sourceType=2&visitorUuid=10bf9775-2b61-4bd3-bbb2-4fe8973f6855&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai&contentPoolId=2ca285d7-8aca-463c-ac25-1b615d9c2519&appearanceId=1014&recommendationType=trending
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash
799ac644117c786cc2f7e5de1aa27ab3df5f36333524998ba990974cd93a6e19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 06 Jun 2021 06:41:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin, Accept-Encoding
x-request-id
7f6a55a6-672f-4b6a-884d-41053afc4382
x-runtime
1.950400
referrer-policy
no-referrer-when-downgrade
etag
W/"799ac644117c786cc2f7e5de1aa27ab3"
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
recommendations
jukebox.pathfactory.com/api/public/v1/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/api/public/v1/recommendations?clientId=LB-9AC90F09-10427&sourceType=2&visitorUuid=10bf9775-2b61-4bd3-bbb2-4fe8973f6855&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai&contentPoolId=2ca285d7-8aca-463c-ac25-1b615d9c2519&appearanceId=1014&recommendationType=yml
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash
d6ccdeb41f1531721110b8284737322a84f379ac3d22d7165bb48fa3e065b603
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 06 Jun 2021 06:41:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin, Accept-Encoding
x-request-id
a9932802-1a70-4429-b9fc-de838c8c0bd2
x-runtime
0.477107
referrer-policy
no-referrer-when-downgrade
etag
W/"d6ccdeb41f1531721110b8284737322a"
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
recommendations
jukebox.pathfactory.com/api/public/v1/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/api/public/v1/recommendations?clientId=LB-9AC90F09-10427&sourceType=2&visitorUuid=10bf9775-2b61-4bd3-bbb2-4fe8973f6855&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F12%2Fevasive-attacker-leverages-solarwinds-supply-chai&contentPoolId=2ca285d7-8aca-463c-ac25-1b615d9c2519&appearanceId=1014&recommendationType=yml
Protocol
H2
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 06 Jun 2021 06:41:48 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol
HTTP/1.1
Server
52.204.168.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-204-168-112.compute-1.amazonaws.com
Software
akka-http/10.0.9 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Content-Type
Access-Control-Allow-Origin
https://www.fireeye.com
Access-Control-Max-Age
5
Date
Sun, 06 Jun 2021 06:41:48 GMT
Server
akka-http/10.0.9
Content-Length
0
Connection
keep-alive
tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ 		2 B
460 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.204.168.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-204-168-112.compute-1.amazonaws.com
Software
akka-http/10.0.9 /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Date
Sun, 06 Jun 2021 06:41:49 GMT
Server
akka-http/10.0.9
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin
https://www.fireeye.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/plain; charset=UTF-8
Content-Length
2
tp2
jukebox.pathfactory.com/com.snowplowanalytics.snowplow/ 		0
420 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

x-runtime
0.008445
date
Sun, 06 Jun 2021 06:41:48 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
vary
Origin, Accept-Encoding
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
text/html
access-control-allow-origin
https://www.fireeye.com
access-control-max-age
1728000
cache-control
no-cache
access-control-allow-credentials
true
x-content-type-options
nosniff
x-request-id
49164dc3-f4ce-4188-ae1c-fa59ea836d0c
access-control-expose-headers
tp2
jukebox.pathfactory.com/com.snowplowanalytics.snowplow/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://jukebox.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol
H2
Server
54.84.172.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-172-129.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 06 Jun 2021 06:41:48 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
jsdata
cas.avalon.perfdrive.com/ 		151 B
210 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cas.avalon.perfdrive.com/jsdata?
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
240.15.241.35.bc.googleusercontent.com
Software
/
Resource Hash
9d20a7db45a52a126a95c8241fc888edcda546aae7c2113efb4bec81e137398f

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
x-response-time
0ms
date
Sun, 06 Jun 2021 06:41:48 GMT
via
1.1 google
alt-svc
clear
content-length
151
content-type
text/plain; charset=UTF-8
jsdata
cas.avalon.perfdrive.com/ 		151 B
272 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cas.avalon.perfdrive.com/jsdata?
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
240.15.241.35.bc.googleusercontent.com
Software
/
Resource Hash
9f3f404095bc18ebf17d0c34f35ca7e19cf04b36ef0905055af9a836116c82a8

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
x-response-time
0ms
date
Sun, 06 Jun 2021 06:41:48 GMT
via
1.1 google
alt-svc
clear
content-length
151
content-type
text/plain; charset=UTF-8
jsdata
cas.avalon.perfdrive.com/ 		151 B
215 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cas.avalon.perfdrive.com/jsdata?
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
240.15.241.35.bc.googleusercontent.com
Software
/
Resource Hash
0c0c0179effe902fefd68aff32c4fd50d1bda5a2bcf8f336d56988a4f9f658c5

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
x-response-time
4ms
date
Sun, 06 Jun 2021 06:41:48 GMT
via
1.1 google
alt-svc
clear
content-length
151
content-type
text/plain; charset=UTF-8
c6b2f539-15fb-4fd9-8a4e-b65b7aaf48ab.otf
app.cdn.lookbookhq.com/lbhq-production/10427/fonts/ 		97 KB
97 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://app.cdn.lookbookhq.com/lbhq-production/10427/fonts/c6b2f539-15fb-4fd9-8a4e-b65b7aaf48ab.otf
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.25.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-25-36.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8049cffe5562f5d5de279ab34e40e0fc5a217283d06eafbcd79aee6d2659e9a4

Request headers

Origin
https://www.fireeye.com
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
null
via
1.1 6f6de2de0e03603ac1b58353376153d3.cloudfront.net (CloudFront)
etag
"cab616e9b0bdf065765cf149a4bb82af"
x-amz-cf-pop
FRA56-C2
x-cache
Hit from cloudfront
access-control-max-age
3000
content-length
99140
last-modified
Mon, 08 Apr 2019 20:27:15 GMT
server
AmazonS3
date
Sun, 06 Jun 2021 06:41:51 GMT
vary
Origin
access-control-allow-methods
GET, PUT, HEAD
access-control-allow-origin
*
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
x-amz-cf-id
G9kt1LVj0Y3_rIZk1TQoVkFbxQoj8u_rLxdycGrVw8j3JzAuEhBQjA==
fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/ 		69 KB
70 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/fontawesome-webfont.woff2?v=4.6.1
Requested by
Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.fireeye.com
Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 06:41:51 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
632, 617, 617
age
3804468
cdn-cachedat
2021-04-23 07:52:38
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
70728
cf-request-id
0a81a7807c00002b65f1951000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
font/woff2
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
8f649c9bb5aa42d1d9619478b7180b7b
accept-ranges
bytes
cf-ray
65afa847293a2b65-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
4016ed74-b343-4630-b53a-4fa4742cd7f2.otf
app.cdn.lookbookhq.com/lbhq-production/10427/fonts/ 		97 KB
98 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://app.cdn.lookbookhq.com/lbhq-production/10427/fonts/4016ed74-b343-4630-b53a-4fa4742cd7f2.otf
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chai
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.25.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-25-36.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5607c31583a387bc428a264f2c51f7c3e332ca288fc7d98247f604b556ac6fdd

Request headers

Origin
https://www.fireeye.com
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
null
via
1.1 6f6de2de0e03603ac1b58353376153d3.cloudfront.net (CloudFront)
etag
"03dfaa3b91df30f10a7e1e9264545db7"
x-amz-cf-pop
FRA56-C2
x-cache
Hit from cloudfront
access-control-max-age
3000
content-length
99364
last-modified
Mon, 08 Apr 2019 20:27:37 GMT
server
AmazonS3
date
Sun, 06 Jun 2021 06:41:51 GMT
vary
Origin
access-control-allow-methods
GET, PUT, HEAD
access-control-allow-origin
*
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
x-amz-cf-id
cwmPeE2vxRDVvLLPDz158V9sAXj3oV6wSOFIcr8qoxM8oWHuqAJcjw==
jsdata
cas.avalon.perfdrive.com/ 		151 B
210 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cas.avalon.perfdrive.com/jsdata?
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
240.15.241.35.bc.googleusercontent.com
Software
/
Resource Hash
ba63084b1fe619c40e581399df9c4c4bcfb425327880dc99d939f8e9c951eb45

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
x-response-time
0ms
date
Sun, 06 Jun 2021 06:41:56 GMT
via
1.1 google
alt-svc
clear
content-length
151
content-type
text/plain; charset=UTF-8
tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
spcollector.pathfactory.com
URL
https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2

Verdicts & Comments Add Verdict or Comment

149 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| dataLayer object| google_tag_manager object| google_optimize function| $ function| jQuery object| matched object| browser object| Granite object| fdc object| geoip2 object| __core-js_shared__ object| core object| Vidyard undefined| cookiesOK function| onAccept function| onDecline function| ipLocation object| jQuery11240365105552070649 object| Configuration string| userAgent boolean| gomezAgent boolean| prtgAgent object| _satellite object| addthis_config object| addthis_share function| showCountryNotification undefined| _6SenseJsonObj undefined| _6SenseTime undefined| isJsonStale undefined| jsonObj function| targetPageParams undefined| companyDetails6Sense undefined| jsonVal undefined| companyRevenueRange undefined| companyCountry undefined| companyIndustry undefined| companyName undefined| companyRegion undefined| companyDomain undefined| segments object| utag_data string| pathname string| urldepth undefined| jobdescription undefined| jobloc function| getParameterByName object| _g function| $CQ object| CQ undefined| G_XHR_HOOK undefined| G_RELOAD_HOOK undefined| G_IS_HOOKED undefined| G_CONTENT_PATH function| _ function| generateURLSignature function| initializeTeaserLoader function| initializeLandingPageLoader object| CQ_Analytics object| CQ_Context boolean| CQ_trackTeasersStats boolean| CQ_trackLandingPagesStats object| ClientContext object| ContextCloud object| _laq boolean| liveAgentDeployment object| liveagent object| feedcontainerSr undefined| feedurlSr undefined| levelsFeedSr undefined| typeofEmp undefined| jobDescriptinUrlSr object| content object| jobFunctionsArray function| displayFeedSR function| filterResultsSR function| getPostings function| populateDropDowns function| replaceQueryParam function| addMissingUTMsFromCookies number| slideTotal number| currentSlide string| target function| getCurrentSlide function| showHideControls string| activeLbox function| calculateTopMargin function| closec08 function| updatec08 function| fixCta function| showNav function| showNavSub function| showNavMore function| initNav number| totalSlides function| changeSlide function| initCarousel function| msieversion undefined| intervalId function| showSuggestions undefined| startTimer function| readCookie object| html5 object| Modernizr function| yepnope object| respond function| postscribe object| google_tag_manager_external object| adobe object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate function| lbhq function| onYouTubeIframeAPIReady function| gtag object| google_tag_data object| __dc_ns_processor function| setImmediate function| clearImmediate boolean| jukeboxInitialized object| GlobalSnowplowNamespace function| jukeboxTracker function| ssResponseCookieReader function| ssRet object| SSJSConnectorObj function| ssConf object| __klbfb object| Snowplow function| ssEnvEvaluator object| ssTimeLogs object| BrowserStyle string| j function| ssJSActionTaker function| ssJSConnWriteCookies number| __sstemp object| ssAnalysisStat object| ssEventCollectorFunctions string| eventName

8 Cookies

Domain/Path Name / Value
www.fireeye.com/ Name: liveagent_ptid
Value: b7df7297-e120-4877-9427-eeb4e44748df
www.fireeye.com/ Name: liveagent_sid
Value: b7df7297-e120-4877-9427-eeb4e44748df
www.fireeye.com/ Name: liveagent_vc
Value: 2
www.fireeye.com/ Name: liveagent_oref
Value:
.fireeye.com/ Name: mboxEdgeCluster
Value: 37
.fireeye.com/ Name: mbox
Value: session#1710b773b757408ab6f6e27445bbf41b#1622963568|PC#1710b773b757408ab6f6e27445bbf41b.37_0#1686206508
.fireeye.com/ Name: _gcl_au
Value: 1.1.637438825.1622961707
.fireeye.com/ Name: check
Value: true

4 Console Messages

Source Level URL
Text
console-api log URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js(Line 378)
Message:
cookie value
console-api log URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js(Line 378)
Message:
cookie value
console-api log URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js(Line 378)
Message:
cookie value
console-api log URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js(Line 378)
Message:
cookie value

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.cdn.lookbookhq.com
c.la2c2.salesforceliveagent.com
cas.avalon.perfdrive.com
cdn.perfdrive.com
cdnjs.cloudflare.com
cloud.typography.com
d.la1-c1-ia5.salesforceliveagent.com
d.la2c2.salesforceliveagent.com
fireeye.tt.omtrdc.net
fonts.googleapis.com
js.maxmind.com
jukebox.pathfactory.com
maxcdn.bootstrapcdn.com
play.vidyard.com
spcollector.pathfactory.com
www.fireeye.com
www.googleoptimize.com
www.googletagmanager.com
spcollector.pathfactory.com
104.109.88.248
13.108.251.135
13.110.44.53
13.32.25.36
130.211.29.114
151.101.13.181
2606:4700:300b::a29f:f67d
2606:4700::6810:125e
2606:4700::6810:252f
2606:4700::6812:acf
2a00:1450:4001:802::200a
2a00:1450:4001:829::200e
2a00:1450:4001:82a::2008
35.241.15.240
52.204.168.112
52.51.251.137
54.84.172.129
013668227d3e7edac274e479349fa3040b52816e5a30fe3eb36465118c635146
03bef1eeac54d221d1da744095e12a9caae78fb47a16f0d9a7598fa83cd79fcf
0c0c0179effe902fefd68aff32c4fd50d1bda5a2bcf8f336d56988a4f9f658c5
1ef89c6057c63e1fd2bda3054817b95cb244d353dc1dafd2736e0ad49ca97924
1f68265c1dfaee5e2034c2ec57e915052c236066259aec53ed35d489f841cecd
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
295cc2973fd8e0ea98700592bf1c04cec651e78313d891e5047cf4e46d2aa667
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
40b7a7f18324515f5e7f8680cef0afccbf0572bc9bea3dd67c9a50083c085676
43589ba59da28a72ed7a6f7d2c56b83cd1b2466a9520f9848517935089405a56
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4945b7b3e791e1d8813c97e2df9d392a99b977362b5c6e4dc24e47851357d7bf
529175b098022074edb4d452b04cccd41edc11cc7381036de99d8a173c6c07c1
5607c31583a387bc428a264f2c51f7c3e332ca288fc7d98247f604b556ac6fdd
57579cbd5bc12cfa9522f8535c8e90a49998f026dc487cdeebca731110cf4104
6980eadbd6f6d6233ea9b987e9ae462b25726871e9797c51e0d550aef3cc861d
716384b3b8c4f5d4e8d89c23b9a4f9516d78f82b6060ae89c493697d7f20f16c
799ac644117c786cc2f7e5de1aa27ab3df5f36333524998ba990974cd93a6e19
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
7c83a52f87765199c12bbac30e2fee7fd3cc20cabf91370b488889373d7a9375
8049cffe5562f5d5de279ab34e40e0fc5a217283d06eafbcd79aee6d2659e9a4
80a1ddbfe525409a87ab1ef6e8ba9c24dfd19bc1607b455633f9e291da08ba9b
847388df8e014402de6e05a34fc2e9e23f937d8eba2fd20d81714d1b678e13e4
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
85b6f75f021535da621a7a7f0974ef384720048e32aba9b217d1252329a287a3
93144b711b7ef4bed3c9b9d28983347edf6d70d2290911886f13467d6cabc911
9499be67341dbf440da185e39df07aca421bfcb879634777989e415b4b87b77c
95fa088f5d480c65fd4e9797ed6042763bce8cbd4f092374b28512daeda3a817
985a53bcdeef61498d5d62a66f67a440ae441de38cced2a9cfbc8bd6b029da58
9d20a7db45a52a126a95c8241fc888edcda546aae7c2113efb4bec81e137398f
9f3f404095bc18ebf17d0c34f35ca7e19cf04b36ef0905055af9a836116c82a8
9fc8ac38f385b6c62ebf86e5b9ac919132fea415d587e42b62766e7217fb404f
a4c67fe8115b40f60d96ecd24873ba492cfdc4d876d1368c1c1142237f56292a
a876a773b46aea97d22c1f84dac918fbc98ee3c1e1729f21cef7911de52f141e
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
b82c98e8c4f4a5c771ef6f061634b0fe49da9f53f915cdf0f576b1cf655db0c1
ba63084b1fe619c40e581399df9c4c4bcfb425327880dc99d939f8e9c951eb45
bb854d12c9f15b7e02f12ed4f774638aba6640d5f6f13a3bfa425dbbf0b745f3
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
c547279d92c72f80e6c580e39599f11d50c552d9cb296adb8eb11938329384fc
c5d851f82aed40520103262006a2c0fd15a861db9d478f3befc4184a6ee67279
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
c9b7d6e7a5672d872763ce1eee54e278c0e2294e4bdb23ba19120e50a757a02b
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
d6ccdeb41f1531721110b8284737322a84f379ac3d22d7165bb48fa3e065b603
d78bfcf1f62b6a4a6c403372ad3a4f46fcf2bda72822ae206129d38de72f4d84
ddeec9dced8be575598e18285dac68896a44a1a39645c772ec6bebd284384067
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236
f7bba0cc484923e9dc8eb46a451efbd2ebe40980e07195777adaa39956bc5cd5
fabf3e1b3923a5f61dcd7d00070c259de08fc9dff32214ea1957e98741ace714
fb384da9d5c974e03adbec0785369381df8f2c656d21faf6d9e10c96612ff14b
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0