www.mandiant.com Open in urlscan Pro
2606:4700:300b::a29f:f07d Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation
Submission Tags: falconsandbox
Submission: On April 18 via api (April 18th 2024, 6:23:21 am UTC) from US — Scanned from DE

Summary HTTP 86 Redirects Links 34 Behaviour Indicators

Summary

This website contacted 31 IPs in 5 countries across 25 domains to perform 86 HTTP transactions. The main IP is 2606:4700:300b::a29f:f07d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.mandiant.com. The Cisco Umbrella rank of the primary domain is 421583.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 2nd 2024. Valid for: 10 months.

This is the only time www.mandiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
30	2606:4700:300... 2606:4700:300b::a29f:f07d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700:310... 2606:4700:3108::ac42:2ad3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
2	2606:4700:10:... 2606:4700:10::ac43:2794	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
1	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
1	2a02:26f0:710... 2a02:26f0:7100::1720:ef19	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE)
1	18.66.102.106 18.66.102.106	16509 (AMAZON-02) (AMAZON-02)
2	104.69.156.245 104.69.156.245	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700::68... 2606:4700::6810:4869	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	13.32.27.19 13.32.27.19	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	54.227.174.173 54.227.174.173	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700:10:... 2606:4700:10::6816:47c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f17... 2a03:2880:f176:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	18.66.112.110 18.66.112.110	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
8	95.100.252.97 95.100.252.97	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:710... 2a02:26f0:7100::210:172	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
86	31

30 2606:4700:300b::a29f:f07d (United States)

ASN13335 (CLOUDFLARENET, US)

www.mandiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:2ad3 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn4.iconfinder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::ac43:2794 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100::1720:ef19 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-106.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.69.156.245 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a104-69-156-245.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4869 (United States)

ASN13335 (CLOUDFLARENET, US)

scout-cdn.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-19.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.227.174.173 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-227-174-173.compute-1.amazonaws.com

scout.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:47c5 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-110.fra56.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

565-pei-952.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 95.100.252.97 (Paris, France)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-100-252-97.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100::210:172 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	mandiant.com www.mandiant.com — Cisco Umbrella Rank: 421583	1 MB
9	6sc.co j.6sc.co — Cisco Umbrella Rank: 5885 c.6sc.co — Cisco Umbrella Rank: 9001 ipv6.6sc.co — Cisco Umbrella Rank: 6019 b.6sc.co — Cisco Umbrella Rank: 3922	20 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 328 www.linkedin.com — Cisco Umbrella Rank: 613 px4.ads.linkedin.com — Cisco Umbrella Rank: 6223	3 KB
6	google.com www.google.com — Cisco Umbrella Rank: 2 region1.analytics.google.com — Cisco Umbrella Rank: 2941	1 KB
6	gstatic.com www.gstatic.com fonts.gstatic.com	247 KB
3	salesloft.com scout-cdn.salesloft.com — Cisco Umbrella Rank: 10820 scout.salesloft.com — Cisco Umbrella Rank: 13740	4 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	21 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 337	14 KB
3	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 3731	28 KB
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 84	403 B
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3820	6 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 737 script.hotjar.com — Cisco Umbrella Rank: 933	59 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	71 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	217 KB
1	mktoresp.com 565-pei-952.mktoresp.com	318 B
1	google.de www.google.de — Cisco Umbrella Rank: 7278	63 B
1	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 2774	231 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 97	273 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 825	395 B
1	t.co t.co — Cisco Umbrella Rank: 678	376 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 781	17 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 795	15 KB
1	iconfinder.com cdn4.iconfinder.com — Cisco Umbrella Rank: 106494	5 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33	2 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 231	5 KB
86	25

	Domain	Requested by
30	www.mandiant.com	www.mandiant.com
6	b.6sc.co
5	www.google.com	www.mandiant.com www.gstatic.com
4	px.ads.linkedin.com	3 redirects snap.licdn.com
4	www.gstatic.com	www.mandiant.com www.google.com www.gstatic.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.mandiant.com
3	static.addtoany.com	www.mandiant.com static.addtoany.com
2	fonts.gstatic.com	fonts.googleapis.com
2	scout.salesloft.com	scout-cdn.salesloft.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	munchkin.marketo.net	www.mandiant.com munchkin.marketo.net
2	connect.facebook.net	www.googletagmanager.com connect.facebook.net
2	www.googletagmanager.com	www.mandiant.com www.googletagmanager.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	j.6sc.co	www.mandiant.com
1	565-pei-952.mktoresp.com	munchkin.marketo.net
1	www.google.de	www.mandiant.com
1	region1.analytics.google.com	www.googletagmanager.com
1	vc.hotjar.io	script.hotjar.com
1	www.facebook.com	www.mandiant.com
1	px4.ads.linkedin.com	www.mandiant.com
1	www.linkedin.com	1 redirects
1	script.hotjar.com	static.hotjar.com
1	analytics.twitter.com	www.mandiant.com
1	t.co	www.mandiant.com
1	scout-cdn.salesloft.com	www.mandiant.com
1	static.hotjar.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	cdn4.iconfinder.com	www.mandiant.com
1	fonts.googleapis.com	www.mandiant.com
1	cdnjs.cloudflare.com	www.mandiant.com
86	34

This site contains links to these domains. Also see Links.

Domain
policies.google.com
cloud.google.com
careers.google.com
login.mandiant.com
www.mandiant.fr
www.mandiant.de
www.mandiant.it
www.mandiant.jp
www.mandiant.kr
www.mandiant.es
advantage.mandiant.com
github.com
help.ivanti.com
forums.ivanti.com
nvd.nist.gov
www.justice.gov
www.technologyreview.com
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com
selling.mandiant.com

Subject Issuer	Validity	Valid
mandiant.com Cloudflare Inc ECC CA-3	`2024-03-02` - `2024-12-31`	10 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
iconfinder.com E1	`2024-03-30` - `2024-06-28`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
static.addtoany.com E1	`2024-02-24` - `2024-05-24`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-01-26` - `2024-04-25`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-04-18` - `2024-06-27`	2 months	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
salesloft.com Sectigo RSA Domain Validation Secure Server CA	`2024-03-20` - `2025-04-19`	a year	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-02-07` - `2025-03-08`	a year	crt.sh
*.google.de GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
6sc.co R3	`2024-04-09` - `2024-07-08`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation
Frame ID: 32398573E665AFA04ACE87381D273C52
Requests: 81 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: 309FFDB05C4CD6167C0A592DC4069215
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&cb=8y0ac51r98lk
Frame ID: 654FB333BFA05ADB37C806AC89F7978C
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&size=compact&cb=6pq81ng3li7a
Frame ID: 0821979518B3089388020026D2D39D41
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: CE7E3F76121852BE5B7DAD7AF1850D37
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: 10077548B19E8F4BEEB80734D79C9530
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MobileIron Log4Shell Exploitation Survey | Forged in Fire

Detected technologies

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

<div[^>]+class="g-recaptcha"
/recaptcha/api\.js

Page Statistics

86
Requests

99 %
HTTPS

65 %
IPv6

25
Domains

34
Subdomains

31
IPs

5
Countries

2038 kB
Transfer

4807 kB
Size

28
Cookies

34 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/technologies/cookies?hl=en
Title: Learn more

Search URL Search Domain Scan URL

URL: https://cloud.google.com/security/sec-ops
Title: Breach Analytics for Chronicle Know what we know when we know it

Search URL Search Domain Scan URL

URL: https://careers.google.com/
Title: Careers Life at Mandiant and open roles

Search URL Search Domain Scan URL

URL: https://login.mandiant.com/
Title: Sign in to Advantage

Search URL Search Domain Scan URL

URL: https://www.mandiant.fr/
Title: Français

Search URL Search Domain Scan URL

URL: https://www.mandiant.de/
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://www.mandiant.it/
Title: Italiano

Search URL Search Domain Scan URL

URL: https://www.mandiant.jp/
Title: 日本

Search URL Search Domain Scan URL

URL: https://www.mandiant.kr/
Title: 한국어

Search URL Search Domain Scan URL

URL: https://www.mandiant.es/
Title: Español

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/cve/vulnerability--3f6bf43b-e5b6-5f24-ba3e-a519e941f8bf
Title: CVE-2021-44228

Search URL Search Domain Scan URL

URL: https://github.com/cisagov/log4j-affected-db
Title: large number of products

Search URL Search Domain Scan URL

URL: https://help.ivanti.com/mi/help/en_US/core/10.7.0.0/gsg/Content/CoreGettingStarted/MobileIron_Core_overview.htm
Title: MobileIron Core

Search URL Search Domain Scan URL

URL: https://forums.ivanti.com/s/article/Security-Bulletin-CVE-2021-44228-Remote-code-injection-in-Log4j?language=en_US
Title: responded to the vulnerability

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/actors/threat-actor--9c88bd9c-f41b-59fa-bfb6-427b1755ea64
Title: APT41 Profile

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/actors/threat-actor--6ca32cd4-0c60-5f0b-91fb-e6e590f1f10b
Title: UNC961 Profile

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/actors/threat-actor--bb67a7a6-399d-51c6-a982-a0c5f136bba8
Title: UNC3500 Profile

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-26084
Title: Atlassian Confluence,

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-35464
Title: ForgeRock AM

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-14750
Title: Oracle Web Logic

Search URL Search Domain Scan URL

URL: https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer
Title: indictment

Search URL Search Domain Scan URL

URL: https://www.technologyreview.com/2021/09/23/1036140/2021-record-zero-day-hacks-reasons/
Title: the worst year on record

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/malware/malware--487dd1af-1763-5af3-878e-dc606dd71f6e
Title: KEYPLUG.LINUX

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/malware/malware--0c6fcbc2-9293-5ade-a1f7-4c0089974794
Title: HOLEPUNCH

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/malware/malware--a942159b-4439-52e1-8c95-251d67172e72
Title: HOLEDOOR

Search URL Search Domain Scan URL

URL: https://advantage.mandiant.com/malware/malware--573fe228-1bc0-57bd-b23a-1d9c02a6d5db
Title: DARKDOOR

Search URL Search Domain Scan URL

URL: https://cloud.google.com/resources/security/cybersecurity-forecast?utm_source=mandiant&utm_medium=website&utm_campaign=FY23-Q4-global-PROD613-website-dl-security-forecast-2024&utm_content=-&utm_term=-
Title: Download now

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Mandiant

Search URL Search Domain Scan URL

URL: https://twitter.com/Mandiant

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCexu0DP7VKdDByusuTA53FQ

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/mandiant/

Search URL Search Domain Scan URL

URL: https://selling.mandiant.com/mandiant/sso.aspx
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy?hl=en-US
Title: Website Privacy Policy

Search URL Search Domain Scan URL

URL: https://cloud.google.com/product-terms#section-15
Title: Terms & Conditions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 44

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1713421396690&li_adsId=4d0458d1-4f1a-4465-83ea-c42792ca9d69&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1713421396690&li_adsId=4d0458d1-4f1a-4465-83ea-c42792ca9d69&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3460746%26time%3D1713421396690%26li_adsId%3D4d0458d1-4f1a-4465-83ea-c42792ca9d69%26url%3Dhttps%253A%252F%252Fwww.mandiant.com%252Fresources%252Fblog%252Fmobileiron-log4shell-exploitation%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1713421396690&li_adsId=4d0458d1-4f1a-4465-83ea-c42792ca9d69&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1713421396690&li_adsId=4d0458d1-4f1a-4465-83ea-c42792ca9d69&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&cookiesTest=true&liSync=true&e_ipv6=AQJGeeqsJJfrdgAAAY7v36yp32vuoFJCVDYn0TKTuR2WdaP_jQCiSBRUbNywcIMnFzufYZ9Agb2G0z3eMrx3XcTAIOTJiQ

86 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request mobileiron-log4shell-exploitation Show response
www.mandiant.com/resources/blog/ 128 KB
31 KB 552ms
519ms Document
text/html 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9594dcb99d8233eb3d6ed0dc94af3b6c14c7a573374fe67c2b0b0b2cdf6d7a00

Security Headers

Name	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: public, max-age=2764800, stale-if-error=3600, stale-while-revalidate=3600
cf-cache-status: EXPIRED
cf-ray: 876290a9de6392a7-FRA
content-encoding: gzip
content-language: en
content-security-policy: report-uri /report-csp-violation
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 06:23:16 GMT
expect-ct: max-age=86400
expires: Sun, 19 Nov 1978 05:00:00 GMT
last-modified: Thu, 18 Apr 2024 05:07:39 GMT
referrer-policy: strict-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
surrogate-control: max-age=86400
vary: Cookie,Accept-Encoding
via: varnish
x-ah-environment: prod
x-cache: HIT
x-cache-hits: 13
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: v-94568d12-fd41-11ee-bee4-abfd6fbdcecc
x-xss-protection: 1; mode=block

GET
H2 200 css_BV3QvYNLGqX2WN35bl9cQh4E3tse6aNfvMOns1RN84U.css
www.mandiant.com/sites/default/files/css/ 22 KB
5 KB 431ms
429ms Stylesheet
text/css 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_BV3QvYNLGqX2WN35bl9cQh4E3tse6aNfvMOns1RN84U.css?delta=0&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2db647fd13ef2dabd1b5cb75dd6c7b7e307bcfedb1811061e6ce7dc9e2bd58f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: MISS
x-ah-environment: prod
content-length: 5148
x-request-id: v-7746cd96-faf7-11ee-ae4a-d7f512ff7956
last-modified: Mon, 15 Apr 2024 07:10:25 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290ad286b92a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css
www.mandiant.com/sites/default/files/css/ 708 KB
83 KB 424ms
422ms Stylesheet
text/css 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4cfceab64cbab69a2c2cd656b4cfc2e1b749cfa45aa234834c4129b6ca64624d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 2
date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 84567
x-request-id: v-364a0ba0-faf7-11ee-804e-0fd065d4c5a7
last-modified: Mon, 15 Apr 2024 07:09:37 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290ad286e92a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H3 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/ 23 KB
5 KB 53ms
17ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 86885
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4364
last-modified: Sat, 06 Jan 2024 12:19:44 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "65993750-110c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ThhqIgII3FtQHGMp3cSRCnStjzbN0JPNFWiN4nrm2T4BAVGJ9pgn4me7a6%2B6DxWMYMnGeKMXQGfwf1gaWpTYpL7CNoSyvAmpFffeEDxG4Cl8QcpAyWn99vXVLUMzD4w3tSWCVrKTIoq1is4EF%2BsLFJvK"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 876290ad5c2f904c-FRA
expires: Tue, 08 Apr 2025 06:23:16 GMT

GET
H2 200 css2
fonts.googleapis.com/ 10 KB
2 KB 60ms
18ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400&family=Google+Sans:wght@500&display=swap

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a9b7a66985bebc105b4b12f2f466fae88b9b16fe17ea5bc1d515753258a0be19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 18 Apr 2024 06:23:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 18 Apr 2024 06:23:16 GMT

GET
H2 200 cookienotificationbar.min.css
www.gstatic.com/glue/cookienotificationbar/ 9 KB
2 KB 58ms
16ms Stylesheet
text/css 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.css

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

591ec898579fc34d46d85f9b22fa8fcfa88465454caa0d86d03e9e6dc0675f9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1670
x-xss-protection: 0
last-modified: Wed, 17 Apr 2024 16:17:18 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="uxe-owners-acl/gstatic"
expires: Thu, 18 Apr 2024 06:23:16 GMT

GET
H3 200 icon-close-512.png
cdn4.iconfinder.com/data/icons/ionicons/512/ 4 KB
5 KB 49ms
25ms Image
image/webp 2606:4700:3108::ac42:2ad3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn4.iconfinder.com/data/icons/ionicons/512/icon-close-512.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:2ad3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7762b4265e6050c33745fd1fae5110f9f265564f0a85d9ac01efaa65029db59c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 2022962
cf-polished: origFmt=png, origSize=8351
content-disposition: inline; filename="icon-close-512.webp"
alt-svc: h3=":443"; ma=86400
content-length: 3858
x-request-id: c127fd81-f9b6-40af-9552-e223a249e4ee
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1709463889&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=hpRA6QxZ6EMJ549Kj72oh2hYsIKdr5HHvPYRdfBwM0s%3D
cf-bgj: imgq:100,h2pri
last-modified: Sat, 23 Mar 2024 09:59:24 GMT
server: cloudflare
vary: Accept
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1709463889&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=hpRA6QxZ6EMJ549Kj72oh2hYsIKdr5HHvPYRdfBwM0s%3D"}]}
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 876290b02c572c00-FRA
expires: Fri, 18 Apr 2025 06:23:16 GMT

GET
H2 200 google-cloud-logo.png
www.mandiant.com/sites/default/files/2023-11/ 6 KB
6 KB 432ms
431ms Image
image/png 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2023-11/google-cloud-logo.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

143f4d7f6d2c5abca7590a6dec282876ef49bc849c886fc7eefbfe3e1c6706fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1832
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 6094
x-request-id: v-1826182e-f73e-11ee-96c3-e3972066c6db
last-modified: Wed, 08 Nov 2023 10:03:19 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290ad286f92a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 report.svg
www.mandiant.com/sites/default/files/2022-11/ 1 KB
796 B 53ms
52ms Image
image/svg+xml 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2022-11/report.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b7ce7007d8d2b26888d2e3296348c5b603fe5fef938221fd1c9f217e9804af8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1720
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 261
x-cache: HIT
x-ah-environment: prod
x-request-id: v-50c03c50-f73e-11ee-b960-4f3dc433c27d
last-modified: Thu, 17 Nov 2022 10:42:25 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 876290ad287092a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 close-icon.svg
www.mandiant.com/themes/custom/mandiant_theme/images/ 215 B
308 B 417ms
417ms Image
image/svg+xml 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/images/close-icon.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa8523773ec663ec32c3612167a9b2b5b1aeb047314d95dd9923b1ad9e0c489a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 16
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-3dd03160-faf7-11ee-9d13-f791ace8de30
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 876290ad78a192a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 js_FooN0L55V0Oq1XP31e7OS0yA1aICCNRxMn37Ahw4ATs.js Show response
www.mandiant.com/sites/default/files/js/ 95 KB
33 KB 418ms
418ms Script
text/javascript 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_FooN0L55V0Oq1XP31e7OS0yA1aICCNRxMn37Ahw4ATs.js?scope=footer&delta=0&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3212d7385c327317abf55280e4e949368eeda26977bbed7761a5a22fc2e2202

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1
date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 33292
x-request-id: v-368635e4-faf7-11ee-a095-a713c3a00f1f
last-modified: Mon, 15 Apr 2024 07:07:51 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290afea1192a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
880 B 33ms
16ms Script
text/javascript 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

aefc3ff4ae77239cdef2fb5bda5b6e561e186270a8ecbf8b525c1deb55d12b8a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Thu, 18 Apr 2024 06:23:16 GMT

GET
H2 200 js_qR8g0supp19B_VPg5JpfovBZSl9y0mAWlZC4abqjhpo.js Show response
www.mandiant.com/sites/default/files/js/ 3 KB
1 KB 413ms
408ms Script
text/javascript 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_qR8g0supp19B_VPg5JpfovBZSl9y0mAWlZC4abqjhpo.js?scope=footer&delta=2&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8885f82460cd5977ef2f391c02cad23cd0262b3d9ec42c4aa92a1ecad0bf461

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 226
date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 1063
x-request-id: v-396b80b6-faf7-11ee-acc1-b3b8d5b2b632
last-modified: Mon, 15 Apr 2024 07:09:38 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b00a2292a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H3 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 34ms
20ms Script
application/javascript 2606:4700:10::ac43:2794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e0cc78c402cbc02fdfd41cd77c5fd6ffbd8066cc07935ea8eb5f3fcc59744a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 25767
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"e346c2841e4abbb66ee259e9540abb61"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bWaDC6EoBz3kJJPA6O3B%2FpFQKI1AxR%2FlTozzpfn8tMfueroZULY4RhIyJJXqebt4eRVxpy%2BXBaWkC3dx1wiln%2FzAb0Dl3wvKXfcNJKwirOlTuaRz8Mu8ZeEaj8olIo2k%2BZpnkgxl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400, stale-while-revalidate=30, public
cf-ray: 876290b01f634da0-FRA

GET
H2 200 js_9AR3RpBc0twolngtQbizsUo8gznm2VRWbr-CFr791YE.js Show response
www.mandiant.com/sites/default/files/js/ 416 KB
124 KB 419ms
414ms Script
text/javascript 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_9AR3RpBc0twolngtQbizsUo8gznm2VRWbr-CFr791YE.js?scope=footer&delta=4&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fa7ca84dc3a040c7199206d3554b4b57d6cbb5c49ef435f674103587640d26a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 237
date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 126527
x-request-id: v-1fb27c10-faf7-11ee-9baf-4fb0a6ebec0a
last-modified: Mon, 15 Apr 2024 07:07:32 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b00a2392a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 accordion.frontend.min.js Show response
www.mandiant.com/modules/contrib/ckeditor_accordion/js/ 4 KB
2 KB 423ms
419ms Script
application/javascript 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/modules/contrib/ckeditor_accordion/js/accordion.frontend.min.js?sbz9u9

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9474894bf64b11c40884f83b0ba6888635bf90bfaae11db1944d99771f1c820

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 141583
date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
via: varnish
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
age: 246946
x-cache: HIT
x-ah-environment: prod
content-length: 1535
x-request-id: v-2d139522-fb0d-11ee-af53-6f7461e4e9f4
last-modified: Fri, 12 Apr 2024 10:21:43 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 876290b00a2492a7-FRA
expires: Mon, 29 Apr 2024 09:47:30 GMT

GET
H2 200 js_EFR6vDeR1WNv9Wdl5BmFcYcYGE4nBaHE8m2MsNebM-0.js Show response
www.mandiant.com/sites/default/files/js/ 20 KB
6 KB 426ms
422ms Script
text/javascript 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_EFR6vDeR1WNv9Wdl5BmFcYcYGE4nBaHE8m2MsNebM-0.js?scope=footer&delta=6&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3245f6cb8d40eebea048a60b056d9a48cbc3e1b0309a0a4cb0e51280f6b0c712

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 238
date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 6309
x-request-id: v-36d55f66-faf7-11ee-80c2-8ffa770cd3c1
last-modified: Mon, 15 Apr 2024 07:07:36 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b00a2592a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 cookienotificationbar.min.js Show response
www.gstatic.com/glue/cookienotificationbar/ 18 KB
7 KB 20ms
15ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9e6dccfd5d4a5d9290b9d4b7e833a5bf73fe58d82beb987296b64230e0d53da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6819
x-xss-protection: 0
last-modified: Wed, 17 Apr 2024 16:17:18 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="uxe-owners-acl/gstatic"
expires: Thu, 18 Apr 2024 06:23:16 GMT

GET
H2 200 fontloader.built.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 7 KB
2 KB 390ms
387ms Script
application/javascript 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/fontloader.built.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 23
date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 2334
x-request-id: v-18d2b252-faf7-11ee-b84b-af8d1c94c195
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b00a2692a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 422 KB
119 KB 54ms
30ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b64c5f7f0d453e3f4c48ce0dbf598d23362bcc6cfc405bc105bcbe7d2609cf20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 121638
x-xss-protection: 0
last-modified: Thu, 18 Apr 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Apr 2024 06:23:16 GMT

GET
H2 200 report.svg
www.mandiant.com/sites/default/files/2022-11/ 1 KB
0 0ms
0ms Image
image/svg+xml 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2022-11/report.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b7ce7007d8d2b26888d2e3296348c5b603fe5fef938221fd1c9f217e9804af8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1720
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 261
x-cache: HIT
x-ah-environment: prod
x-request-id: v-50c03c50-f73e-11ee-b960-4f3dc433c27d
last-modified: Thu, 17 Nov 2022 10:42:25 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 876290ad287092a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 gray-circle.png
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/backgrounds/ 9 KB
9 KB 419ms
418ms Image
image/png 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/backgrounds/gray-circle.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cfbbb6a8bb9482b6bddbba133d70d9ac28fea886ede20ecdaf3110d5c70dba6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 9
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 8943
x-request-id: v-3636c84c-faf7-11ee-8284-2ff9272d0bc1
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b01a3392a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 insights-for-future-planning.png
www.mandiant.com/sites/default/files/2023-11/ 149 KB
149 KB 53ms
53ms Image
image/png 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2023-11/insights-for-future-planning.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

acb33e5d72259c82bef8f6d6ddfc56bbdf4130739d3271a437b4d0065c390d9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1776
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 150
x-cache: HIT
x-ah-environment: prod
content-length: 152443
x-request-id: v-06cc14c0-f73e-11ee-a842-236a9a8cc5be
last-modified: Wed, 08 Nov 2023 10:02:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b02a3492a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 magenta-to-red-gradient.jpg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 61 KB
61 KB 415ms
415ms Image
image/jpeg 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/magenta-to-red-gradient.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce56dc3783735b873af61135d410e3ccec9dfd565a5961fd707e85d1d6b654af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 16
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 62175
x-request-id: v-1f53cdd2-faf7-11ee-b115-271f72e30fef
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
cf-bgj: h2pri
server: cloudflare
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b02a3592a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 white-cta-arrow.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 750 B
466 B 451ms
451ms Image
image/svg+xml 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/white-cta-arrow.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff46ab88d5fe2880ee24e0a56c4f423096ea4eb7b80e0fc8032319e26b5a002b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 13
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-37001fb2-faf7-11ee-bac3-ebfdfd4e25ac
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 876290b02a3792a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 footer-bg-transparent.png
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 134 KB
134 KB 428ms
427ms Image
image/png 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/footer-bg-transparent.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 17
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 136986
x-request-id: v-1f5f18b8-faf7-11ee-a096-2320eec27610
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b02a3892a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 MaterialIcons-Outlined.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/ 148 KB
148 KB 57ms
56ms Font
text/plain 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/MaterialIcons-Outlined.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 2
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 264
x-cache: HIT
x-ah-environment: prod
content-length: 151244
x-request-id: v-1f40aa9a-faf7-11ee-bd67-9b146a8eeb5b
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b06a6492a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 Barlow-Bold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 56 KB
56 KB 51ms
49ms Font
text/plain 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Bold.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 5
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 264
x-cache: HIT
x-ah-environment: prod
content-length: 57572
x-request-id: v-2071ad4c-faf7-11ee-b86d-a7b209a95980
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b06a6892a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 Barlow-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 55 KB
55 KB 52ms
51ms Font
text/plain 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Regular.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 3
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 259
x-cache: HIT
x-ah-environment: prod
content-length: 56020
x-request-id: v-1f961980-faf7-11ee-834a-030f0b5481d2
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b06a6b92a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 GoogleSansDisplay-Medium.ttf
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/ 154 KB
76 KB 43ms
42ms Font
application/font-sfnt 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/GoogleSansDisplay-Medium.ttf

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40c1436cb0e94370dee18db4f09e3eb8e199713919adb33295536e6c26d9b74d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 264
x-cache: MISS
x-ah-environment: prod
x-request-id: v-3df9a28e-faf7-11ee-8576-5bd01e44fe37
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/font-sfnt
cache-control: public, max-age=1209600
cf-ray: 876290b06a6c92a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 GoogleSans-Regular.ttf
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/ 154 KB
75 KB 49ms
48ms Font
application/font-sfnt 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/GoogleSans-Regular.ttf

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8914b020e2c78fe86ca14198095455139f08047b8b52ab69003cb5af35cbbc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 263
x-cache: MISS
x-ah-environment: prod
x-request-id: v-3dfbfd2c-faf7-11ee-a0cd-cf070ceca180
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/font-sfnt
cache-control: public, max-age=1209600
cf-ray: 876290b06a6d92a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 295 KB
98 KB 26ms
25ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9bb6b31d6ee3cf33b3bb0f720ebac0c09b3e95023b4c0815b0216c271efb4d7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 100066
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Apr 2024 06:23:16 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 34ms
6ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
last-modified: Fri, 22 Mar 2024 21:07:24 GMT
x-amz-server-side-encryption: AES256
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15412
x-served-by: cache-iad-kiad7000168-IAD, cache-fra-etou8220108-FRA

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 43ms
7ms Script
application/javascript 2a02:26f0:7100::1720:ef19
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100::1720:ef19 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 07:42:51 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=13693
accept-ranges: bytes
content-length: 17238

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
59 KB 29ms
8ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

85f407912384186334577f65bf6bb88045bd96f5222d7c696cc71303d65c826a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 18 Apr 2024 06:23:16 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57850
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=12, mss=1326, tbw=2761, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: tNQlpvR+igolQLCWqGWsGUj2J0I1a25EPWj91X2nFQCk8wojNW6IwpCsmSwqXTVFeJ+IVtTdLYk29iLELjcl3g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 69ms
31ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Thu, 18 Apr 2024 06:23:15 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 26FC0B93523E479FB0D247961E3DDAF1 Ref B: FRA31EDGE0707 Ref C: 2024-04-18T06:23:16Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 31ms
6ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 18 Apr 2024 05:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2108
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 18 Apr 2024 07:48:08 GMT

GET
H2 200 hotjar-3008912.js Show response
static.hotjar.com/c/ 9 KB
4 KB 33ms
9ms Script
application/javascript 18.66.102.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3008912.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.106 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-106.fra56.r.cloudfront.net

Software

Resource Hash

27fe50b71088d1f9f47df0854172b86b379619e70cd372188a6c77afb7016ebb

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:02 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 59d5785a1d012a54118141e7e216a492.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 14
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/23afb08ece52f04b2aa36802e253b97c
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=60
x-cache-hit: 1
x-amz-cf-id: HZSebwKKRHUKWaFPopKyRSFgnqkkHmVLaL6-M3eU5dLLjmmML8kMWw==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 589ms
196ms Script
application/x-javascript 104.69.156.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.156.245 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-156-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 18 Apr 2024 06:23:17 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 sl.js Show response
scout-cdn.salesloft.com/ 6 KB
3 KB 107ms
19ms Script
application/javascript 2606:4700::6810:4869
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://scout-cdn.salesloft.com/sl.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:4869 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
x-amz-version-id: 6anzvBQcvmaBDc8BSO9zI6Th.IIiwArc
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: EZPGEPEQRJ835T56
age: 6015
alt-svc: h3=":443"; ma=86400
x-amz-id-2: vj/H9CfyiKNwtvLJrelCw6CtXo93qB0KDTwbomYs8Kf/kZA94jYHXVgMqek/RNtsa+9eO7BrPxA=
last-modified: Mon, 13 Dec 2021 16:28:37 GMT
server: cloudflare
etag: W/"d74cc4825c8e333b2116da3fcc649db1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 876290b178a865d7-FRA
expires: Thu, 18 Apr 2024 10:23:16 GMT

GET
H2 200 adsct
t.co/i/ 43 B
376 B 145ms
117ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=c5aab1e8-7610-4efc-a8bb-3619d8502895&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=95dcb614-9969-41ac-bbd0-548cf7bc9581&tw_document_href=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o5b0k&type=javascript&version=2.3.30

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 109
date: Thu, 18 Apr 2024 06:23:16 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 06e612b38a76ce7a
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 661f38992340f2d7f3f35329cae472aa7b4d91a990f62995485d09bdc2ff06d7
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
395 B 149ms
116ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=c5aab1e8-7610-4efc-a8bb-3619d8502895&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=95dcb614-9969-41ac-bbd0-548cf7bc9581&tw_document_href=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o5b0k&type=javascript&version=2.3.30

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 109
date: Thu, 18 Apr 2024 06:23:16 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 0356e750d2eb0808
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 231f5ceeaa9494cf7488edd8457a5427343a66f58b031820344bfd767dd8221b
content-length: 43

GET
H2 200 modules.9c3b50ddbc74247d2ae3.js Show response
script.hotjar.com/ 221 KB
55 KB 36ms
7ms Script
application/javascript 13.32.27.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.9c3b50ddbc74247d2ae3.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3008912.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-19.fra56.r.cloudfront.net

Software

Resource Hash

84abbb88240359c728c738ec4acb83fc354afd75d7470279f1fe01f9841e5f4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 17:11:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 133930
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55691
last-modified: Tue, 16 Apr 2024 17:10:18 GMT
etag: "cb9e8e6a84fdeebfc271614ce016b88e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: -PJ5xMXmMMNF0sOCjH_KFBout0XphW05mpvvzfe6-j1t_3lgHRhG5w==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
209 B 16ms
14ms XHR
text/plain 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=1198190628&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&ul=de-de&de=UTF-8&dt=MobileIron%20Log4Shell%20Exploitation%20Survey%20%7C%20Forged%20in%20Fire&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEABAAAAACAEK~&jid=1740068438&gjid=1251155132&cid=208561041.1713421397&tid=UA-203244293-1&_gid=1498624105.1713421397&_slc=1&gtm=45He44f0n81T72STLDv849727317za200&cg1=blog&cg2=resources&cd2=Pageview&cd3=1713421396611.fhi32v23&cd4=2024-04-18T08%3A23%3A16.611%2B02%3A00&cd5=&cd15=geoff%20ackerman%2C%20tufail%20ahmed%2C%20james%20maclachlan%2C%20dallin%20warne%2C%20john%20wolfram%2C%20brandon%20wilbur&cd16=mar%2028%2C%202022&cd24=unknown&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&cd1=208561041.1713421397&npa=1&z=538034282

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
347 B 56ms
17ms XHR
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-203244293-1&cid=208561041.1713421397&jid=1740068438&gjid=1251155132&_gid=1498624105.1713421397&npa=1&_u=YGBAgEABAAAAAGAEK~&z=2024895914

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 18 Apr 2024 06:23:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1713421396690&li_adsId=4d0458d1-4f1a-4465-83ea-c42792ca9d69&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4sh...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1713421396690&li_adsId=4d0458d1-4f1a-4465-83ea-c42792ca9d69&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4sh...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3460746%26time%3D1713421396690%26li_adsId%3D4d0458d1-4f1a-4465-83ea-c42792ca9d69%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1713421396690&li_adsId=4d0458d1-4f1a-4465-83ea-c42792ca9d69&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4sh...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1713421396690&li_adsId=4d0458d1-4f1a-4465-83ea-c42792ca9d69&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4s...

0
264 B

138ms
108ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1713421396690&li_adsId=4d0458d1-4f1a-4465-83ea-c42792ca9d69&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&cookiesTest=true&liSync=true&e_ipv6=AQJGeeqsJJfrdgAAAY7v36yp32vuoFJCVDYn0TKTuR2WdaP_jQCiSBRUbNywcIMnFzufYZ9Agb2G0z3eMrx3XcTAIOTJiQ
Requested by: Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 0DF1C0E72C204D2F8F6F557F8B6D356C Ref B: FRAEDGE1310 Ref C: 2024-04-18T06:23:17Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYWWQG8w7soAtT1rGcDyQ==

Redirect headers

date: Thu, 18 Apr 2024 06:23:17 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 461CAA0C65064733A8E29315BB2CA440 Ref B: FRAEDGE1419 Ref C: 2024-04-18T06:23:17Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1713421396690&li_adsId=4d0458d1-4f1a-4465-83ea-c42792ca9d69&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&cookiesTest=true&liSync=true&e_ipv6=AQJGeeqsJJfrdgAAAY7v36yp32vuoFJCVDYn0TKTuR2WdaP_jQCiSBRUbNywcIMnFzufYZ9Agb2G0z3eMrx3XcTAIOTJiQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYWWQG6WOmKA4lE3JElVg==

GET
H2 200 880805232811859 Show response
connect.facebook.net/signals/config/ 56 KB
12 KB 160ms
159ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/880805232811859?v=2.9.154&r=stable&domain=www.mandiant.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

be2a5e50e8dda09c9ccb17f0fce9143199ec092d05a2c418b47ef6cda5cda280

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 18 Apr 2024 06:23:16 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=63, mss=1326, tbw=63199, tp=-1, tpl=-1, uplat=151, ullat=0
pragma: public
x-fb-debug: N2HuMfZkkJ+QnpgGdE/m8GqM7W8mUxJNSxejd4l5Rn17+WGZWZMumfADHRTqjVzXaH+IyeveX1h8h8yInMMppw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 r Show response
scout.salesloft.com/ 41 B
358 B 306ms
95ms XHR
application/json 54.227.174.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/r?tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0IjoxMDUwMDl9.GHpZgHyRyFl9iN7anlcbMbmW3chPCQZrSX98AJ7UjM8

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.227.174.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-227-174-173.compute-1.amazonaws.com

Software

Resource Hash

1cfea949b0b2925d27b84d56d18f2ea1c6b948fdf3ae95c534a14706043da178

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mandiant.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 41
x-request-id: aa631483ff1e3469bfb85fec338be2b4

GET
H2 204 5870833.js Show response
bat.bing.com/p/action/ 0
118 B 34ms
34ms Script
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5870833.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Thu, 18 Apr 2024 06:23:15 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4353A09EB6F54FD5906896A57B1EEB57 Ref B: FRA31EDGE0707 Ref C: 2024-04-18T06:23:16Z
x-cache: CONFIG_NOCACHE

GET
H2 200 PTMono-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/ 71 KB
71 KB 37ms
37ms Font
text/plain 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/PTMono-Regular.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 2
date: Thu, 18 Apr 2024 06:23:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 259
x-cache: HIT
x-ah-environment: prod
content-length: 72380
x-request-id: v-1fd7c7d6-faf7-11ee-a1b8-c790a47ebce7
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b27b9692a7-FRA
expires: Thu, 02 May 2024 06:23:16 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/ 501 KB
201 KB 24ms
8ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3958a93184f498eaa140c746fa8b3ce7e540d38898f2b1c1acf9c7e8f6c5f429

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 10:09:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72851
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205471
x-xss-protection: 0
last-modified: Fri, 29 Mar 2024 04:30:36 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 17 Apr 2025 10:09:05 GMT

GET
H3 200 sm.25.html
static.addtoany.com/menu/ Frame 309F 0
0 39ms
27ms Document
text/html 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
age: 13655
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 876290b2b9d79738-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 18 Apr 2024 06:23:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zf100L6iTlFg050p7ry6jRCgFGHrlS0bsxSt474zPbv6Js%2FpRKoLWALzrYpDxRf3QjEFWUE4M2zn0fPIU%2FMuTy3YgdnJMM4pjeMhyeSgmPbO3S%2BATW9DbP6u5N%2FFxnuqjOOjZMjq"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 core.BRQnzO8v.js Show response
static.addtoany.com/menu/modules/ 70 KB
26 KB 34ms
24ms Script
application/javascript 2606:4700:10::ac43:2794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.BRQnzO8v.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b9b24f0aa59668e4d0a770ee7a294b9baa361a76a20ade8128cd0482a5d805

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 19617
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"25da5432b1057724b8210f17e9b9db05"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0xIh%2BHG5oZPZjPzl6e%2FdNPynR%2B7SmGMvgtEZH2aM5wRldFHy5SUj07qbFp48oqtVruvJyS8LxyfHEVBBJpjLUYeI3FhNDkTel%2B%2BzQyvQtsH4gbapuP0oW5X9b8FiW3wpE%2F3tp%2F%2Fnj5%2FVosg5yX0zSoIG"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000, immutable
cf-ray: 876290b2b8a6372e-FRA

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 46ms
11ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=880805232811859&ev=PageView&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&rl=&if=false&ts=1713421396908&sw=1600&sh=1200&v=2.9.154&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4125&fbp=fb.1.1713421396908.403658966&ler=empty&cdl=API_unavailable&it=1713421396729&coo=false&tm=1&rqm=GET

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=8, rtx=0, c=10, mss=1326, tbw=2755, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 18 Apr 2024 06:23:16 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 974.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 11 KB
3 KB 410ms
410ms Script
application/javascript 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/974.bundle.js?ed9f0d

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_9AR3RpBc0twolngtQbizsUo8gznm2VRWbr-CFr791YE.js?scope=footer&delta=4&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

201492c149f68b701455a2d046549a318a76ed5bca4ab13ebd913dbd14710246

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 16
date: Thu, 18 Apr 2024 06:23:17 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 3375
x-request-id: v-2018c862-faf7-11ee-b196-576f2ffde781
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b31bf492a7-FRA
expires: Thu, 02 May 2024 06:23:17 GMT

GET
H2 200 404.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 406 B
398 B 406ms
406ms Script
application/javascript 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/404.bundle.js?2c5f80

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 15
date: Thu, 18 Apr 2024 06:23:17 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 263
x-request-id: v-20468220-faf7-11ee-bb33-736e25b1181c
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b31bf592a7-FRA
expires: Thu, 02 May 2024 06:23:17 GMT

GET
H2 200 Barlow-SemiBold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 56 KB
57 KB 44ms
42ms Font
text/plain 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-SemiBold.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 3
date: Thu, 18 Apr 2024 06:23:17 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 259
x-cache: HIT
x-ah-environment: prod
content-length: 57764
x-request-id: v-20b75ebe-faf7-11ee-94f6-6b53408699ed
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b3ac5092a7-FRA
expires: Thu, 02 May 2024 06:23:17 GMT

GET
H2 200 Barlow-Medium.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 55 KB
55 KB 29ms
28ms Font
text/plain 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Medium.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 3
date: Thu, 18 Apr 2024 06:23:17 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 260
x-cache: HIT
x-ah-environment: prod
content-length: 55968
x-request-id: v-20b8d866-faf7-11ee-8728-1f211c48d485
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b3ac5392a7-FRA
expires: Thu, 02 May 2024 06:23:17 GMT

GET
H2 200 Barlow-MediumItalic.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 59 KB
59 KB 34ms
33ms Font
text/plain 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-MediumItalic.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

34e89fde702aa592d82afbb8d98034150cb3a2e6bd67a922af1edd106cf87fe8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/sites/default/files/css/css_26Sf8J_-Zf6VktbA85RgUYKGRAEdQBP4CVSF0VF16O8.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_X6_bukrpCzru4A4xi1bPm8H8CwKm5IKtwx-4zirNA-3mUmPllBHem0hmwbo5V5jQOFRsg24e_caVYWnD-mLeC9tn7evE31k9E5aL42SB1pHjohGJRFOWBi_0cx239G-hTLg53RBeKOYxsyj62HjLOhhXg4q6skv8fsFJ3FQWZbM4oYaCXXaPKRvJOLGDNCYp4Z75MHjWa5W0Fz75LPkcfGTlWbHyA82lmn8
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 3
date: Thu, 18 Apr 2024 06:23:17 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 259
x-cache: HIT
x-ah-environment: prod
content-length: 60612
x-request-id: v-20babc94-faf7-11ee-9cd2-8b9c18070209
last-modified: Fri, 12 Apr 2024 10:21:45 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 876290b3ac5492a7-FRA
expires: Thu, 02 May 2024 06:23:17 GMT

GET
H3 200 2a.json Show response
www.gstatic.com/glue/cookienotificationbar/config/ 428 B
224 B 15ms
15ms Fetch
application/json 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/glue/cookienotificationbar/config/2a.json?hl=en

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a1a28e26e577545cac3166880d39b6188156245e5d4b532f559be34ef1476f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:17 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 198
x-xss-protection: 0
last-modified: Thu, 01 Feb 2024 19:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="uxe-owners-acl/gstatic"
expires: Thu, 18 Apr 2024 06:23:17 GMT

GET
H2 200 i Show response
scout.salesloft.com/ 48 B
465 B 97ms
96ms XHR
application/json 54.227.174.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/i

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.227.174.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-227-174-173.compute-1.amazonaws.com

Software

Resource Hash

54c80c16822515c155d73ba0189681e678eacc8e7a3ab0aff9d164f027d7216a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mandiant.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 48
x-request-id: 3f809efd15830ec4b4cb306ddafbf0d9

GET
H2 204 3008912 Show response
vc.hotjar.io/sessions/ 0
231 B 79ms
34ms XHR
text/plain 18.66.112.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/3008912?s=0.25&r=0.11238285932015568
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.9c3b50ddbc74247d2ae3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-110.fra56.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Thu, 18 Apr 2024 06:23:17 GMT
cache-control: no-store
via: 1.1 0162e02b2d0212054988a68716227daa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: lOeY521BRqIdllROGnQweRj0MsqcvtA23oKlXW9TCBQxp3LwOvJzmg==
x-cache: Miss from cloudfront

GET
H2 204 0
bat.bing.com/action/ 0
287 B 32ms
32ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5870833&tm=gtm002&Ver=2&mid=e4a373d0-4413-499a-a540-84b7ae34fe1b&sid=24bf2480fd4c11ee9de63377c1e578a4&vid=24bf4c00fd4c11ee8fa7773023135878&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=MobileIron%20Log4Shell%20Exploitation%20Survey%20%7C%20Forged%20in%20Fire&kw=mobileiron%20log4shell%20exploitation&p=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&r=&lt=1626&evt=pageLoad&sv=1&rn=895688

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 18 Apr 2024 06:23:16 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F728B462DEAE45B3AE248816B3E284CE Ref B: FRA31EDGE0707 Ref C: 2024-04-18T06:23:17Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2
fonts.gstatic.com/s/googlesanstext/v21/ 14 KB
15 KB 34ms
12ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesanstext/v21/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400&family=Google+Sans:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8300ba70904617a47a80e9098fe00b3f7aefd328519318c420289b0bbdfb5e2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 04:48:31 GMT
x-content-type-options: nosniff
age: 178486
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14796
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:47:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Apr 2025 04:48:31 GMT

GET
H2 200 4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrw2IJllpyk.woff2
fonts.gstatic.com/s/googlesans/v58/ 22 KB
22 KB 31ms
10ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrw2IJllpyk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400&family=Google+Sans:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7f62ccd6d9784466fb9b92202b71a63182de790d0575e13641e027b39e0590e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://www.mandiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 15 Apr 2024 20:44:26 GMT
x-content-type-options: nosniff
age: 207531
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22308
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Apr 2025 20:44:26 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 192ms
192ms Script
application/x-javascript 104.69.156.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.156.245 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-156-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 18 Apr 2024 06:23:17 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Sat, 27 Jul 2024 06:23:17 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
255 B 43ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-X6642ZTDJ7&_ng=1&gtm=45je44f0v883779794z8849727317za200&_p=1713421396479&_gaz=1&gcs=G111&gcd=13t3tPl2l5&npa=1&dma_cps=sypham&dma=1&cid=208561041.1713421397&ul=de-de&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_eu=EA&_s=1&sid=1713421396&sct=1&seg=0&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&dt=MobileIron%20Log4Shell%20Exploitation%20Survey%20%7C%20Forged%20in%20Fire&en=page_view&_fv=1&_ss=1&tfd=1769
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 17ms
16ms Ping
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ng=1&tid=G-X6642ZTDJ7&cid=208561041.1713421397&gtm=45je44f0v883779794z8849727317za200&aip=1&dma=1&dma_cps=sypham&gcs=G111&gcd=13t3tPl2l5&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 35ms
17ms Image
image/gif 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ng=1&tid=G-X6642ZTDJ7&cid=208561041.1713421397&gtm=45je44f0v883779794z8849727317za200&aip=1&dma=1&dma_cps=sypham&gcs=G111&gcd=13t3tPl2l5&npa=1&z=1604277701

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
195 B 115ms
115ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer: https://www.mandiant.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:17 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 53CCA23BABF146619C22A1AEA01D5282 Ref B: FRAEDGE1419 Ref C: 2024-04-18T06:23:17Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://www.mandiant.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYWWQG+hyahRAmixcFFHw==

POST
H/1.1 200
OK visitWebPage
565-pei-952.mktoresp.com/webevents/ 2 B
318 B 574ms
95ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://565-pei-952.mktoresp.com/webevents/visitWebPage?_mchNc=1713421397417&_mchCn=&_mchId=565-PEI-952&_mchTk=_mch-mandiant.com-1713421397414-19929&_mchHo=www.mandiant.com&_mchPo=&_mchRu=%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 18 Apr 2024 06:23:17 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: ce308941-8bd0-448f-9f92-90cf36df4689

GET
H2 200 6si.min.js Show response
j.6sc.co/ 65 KB
18 KB 81ms
16ms Script
application/javascript 95.100.252.97
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.100.252.97 Paris, France, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-100-252-97.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

df4d1ff8adb72502d1b262d0a8af4c3c902ff5e37e442861f5a9fed51d75d18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 21:38:47 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "6615b567-102f4"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17825
expires: Thu, 18 Apr 2024 06:23:17 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1198190628&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&ul=de-de&de=UTF-8&dt=MobileIron%20Log4Shell%20Exploitation%20Survey%20%7C%20Forged%20in%20Fire&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Resource%20Type&ea=blog&el=Forged%20in%20Fire%3A%20A%20Survey%20of%20MobileIron%20Log4Shell%20Exploitation&_u=aGDAgEABAAAAAGAEK~&jid=&gjid=&cid=208561041.1713421397&tid=UA-203244293-1&_gid=1498624105.1713421397&gtm=45He44f0n81T72STLDv849727317za200&cg1=blog&cg2=resources&cd3=1713421397432.ce12imb&cd4=2024-04-18T08%3A23%3A17.432%2B02%3A00&cd5=&cd15=geoff%20ackerman%2C%20tufail%20ahmed%2C%20james%20maclachlan%2C%20dallin%20warne%2C%20john%20wolfram%2C%20brandon%20wilbur&cd16=mar%2028%2C%202022&cd24=unknown&gcd=13t3t3l2l5&dma_cps=sypham&dma=1&cd1=208561041.1713421397&gcs=G111&npa=1&z=616288654

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 01:28:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 17673
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 favicon.ico
www.mandiant.com/themes/custom/mandiant_theme/ 41 KB
1 KB 421ms
420ms Other
image/vnd.microsoft.icon 2606:4700:300b::a29f:f07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41d8731c789eeefe8cfc070d37c21cf501f733c1fd736d94772b2f0d7b46a610

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 7
date: Thu, 18 Apr 2024 06:23:17 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-216b465e-faf7-11ee-a5ba-537eda92eaa3
last-modified: Fri, 12 Apr 2024 10:21:44 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/vnd.microsoft.icon
cache-control: public, max-age=1209600
cf-ray: 876290b65dc592a7-FRA
expires: Thu, 02 May 2024 06:23:17 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 28ms
17ms XHR
text/html 95.100.252.97
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.252.97 Paris, France, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-100-252-97.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 06:23:17 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.mandiant.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 36 B
336 B 48ms
13ms XHR
text/html 2a02:26f0:7100::210:172
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b5b5fd289870f9c111d2f32e53d5d220becac55773f34da6196dd04224eaa1e9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:17 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.mandiant.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a02:6ea0:c71b:0:1012:4f65:a849:b25d
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1713421397585_34603374_191111216_22_908_5_19_219";dur=1
content-length: 36
expires: Thu, 18 Apr 2024 06:23:17 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 112ms
104ms Image
image/gif 95.100.252.97
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=9004e317-8e75-44e8-82af-80f70759447e&session=43f97038-6af2-4b73-8d6c-ca99f5f714c8&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2018%20Apr%202024%2006%3A23%3A17%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22MobileIron%20Log4Shell%20Exploitation.%20We%20examine%20the%20exploitation%20of%20MobileIron%20servers%20by%204%20unique%20adversaries%2C%20providing%20insight%20into%20each%20group%E2%80%99s%20operations.%22%2C%22keywords%22%3A%22mobileiron%20log4shell%20exploitation%22%2C%22title%22%3A%22MobileIron%20Log4Shell%20Exploitation%20Survey%20%7C%20Forged%20in%20Fire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&pageViewId=e22dc2d8-3bd0-41ae-8f2c-7f31494340c0&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.100.252.97 Paris, France, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-100-252-97.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:17 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 18 Apr 2024 06:23:17 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 113ms
105ms Image
image/gif 95.100.252.97
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=9004e317-8e75-44e8-82af-80f70759447e&session=43f97038-6af2-4b73-8d6c-ca99f5f714c8&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2018%20Apr%202024%2006%3A23%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22627b22264f359a2be8e661bd05849ae6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2018%20Apr%202024%2006%3A23%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2018%20Apr%202024%2006%3A23%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2018%20Apr%202024%2006%3A23%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22MobileIron%20Log4Shell%20Exploitation.%20We%20examine%20the%20exploitation%20of%20MobileIron%20servers%20by%204%20unique%20adversaries%2C%20providing%20insight%20into%20each%20group%E2%80%99s%20operations.%22%2C%22keywords%22%3A%22mobileiron%20log4shell%20exploitation%22%2C%22title%22%3A%22MobileIron%20Log4Shell%20Exploitation%20Survey%20%7C%20Forged%20in%20Fire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&pageViewId=e22dc2d8-3bd0-41ae-8f2c-7f31494340c0&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.100.252.97 Paris, France, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-100-252-97.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:17 GMT
x-content-type-options: nosniff
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 18 Apr 2024 06:23:17 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 96ms
96ms Image
image/gif 95.100.252.97
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=9004e317-8e75-44e8-82af-80f70759447e&session=43f97038-6af2-4b73-8d6c-ca99f5f714c8&event=ipv6&q=%7B%22address%22%3A%222a02%3A6ea0%3Ac71b%3A0%3A1012%3A4f65%3Aa849%3Ab25d%22%7D&isIframe=false&m=%7B%22description%22%3A%22MobileIron%20Log4Shell%20Exploitation.%20We%20examine%20the%20exploitation%20of%20MobileIron%20servers%20by%204%20unique%20adversaries%2C%20providing%20insight%20into%20each%20group%E2%80%99s%20operations.%22%2C%22keywords%22%3A%22mobileiron%20log4shell%20exploitation%22%2C%22title%22%3A%22MobileIron%20Log4Shell%20Exploitation%20Survey%20%7C%20Forged%20in%20Fire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&pageViewId=e22dc2d8-3bd0-41ae-8f2c-7f31494340c0&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.100.252.97 Paris, France, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-100-252-97.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:17 GMT
x-content-type-options: nosniff
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 18 Apr 2024 06:23:17 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 96ms
95ms Image
image/gif 95.100.252.97
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=9004e317-8e75-44e8-82af-80f70759447e&session=43f97038-6af2-4b73-8d6c-ca99f5f714c8&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2018%20Apr%202024%2006%3A23%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2018%20Apr%202024%2006%3A23%3A17%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%221006%22%7D&isIframe=false&m=%7B%22description%22%3A%22MobileIron%20Log4Shell%20Exploitation.%20We%20examine%20the%20exploitation%20of%20MobileIron%20servers%20by%204%20unique%20adversaries%2C%20providing%20insight%20into%20each%20group%E2%80%99s%20operations.%22%2C%22keywords%22%3A%22mobileiron%20log4shell%20exploitation%22%2C%22title%22%3A%22MobileIron%20Log4Shell%20Exploitation%20Survey%20%7C%20Forged%20in%20Fire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&pageViewId=e22dc2d8-3bd0-41ae-8f2c-7f31494340c0&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.100.252.97 Paris, France, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-100-252-97.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:18 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 18 Apr 2024 06:23:18 GMT

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 654F 0
0 49ms
34ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&cb=8y0ac51r98lk

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ojJIjAS0NKxaEgaumL4moQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-ojJIjAS0NKxaEgaumL4moQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 18 Apr 2024 06:23:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 0821 0
0 47ms
35ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&size=compact&cb=6pq81ng3li7a

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-88A7CPyCAcjIF3pxXO3zSg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-88A7CPyCAcjIF3pxXO3zSg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 18 Apr 2024 06:23:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 bframe
www.google.com/recaptcha/api2/ Frame CE7E 0
0 22ms
22ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-vEWDhrYa6TakxFpfgcECug' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-vEWDhrYa6TakxFpfgcECug' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 18 Apr 2024 06:23:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 bframe
www.google.com/recaptcha/api2/ Frame 1007 0
0 37ms
21ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-G8Mls5uMfn5PtvUD_2b3Gw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-G8Mls5uMfn5PtvUD_2b3Gw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 18 Apr 2024 06:23:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 103ms
103ms Image
image/gif 95.100.252.97
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=9004e317-8e75-44e8-82af-80f70759447e&session=43f97038-6af2-4b73-8d6c-ca99f5f714c8&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2018%20Apr%202024%2006%3A23%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2018%20Apr%202024%2006%3A23%3A18%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222007%22%7D&isIframe=false&m=%7B%22description%22%3A%22MobileIron%20Log4Shell%20Exploitation.%20We%20examine%20the%20exploitation%20of%20MobileIron%20servers%20by%204%20unique%20adversaries%2C%20providing%20insight%20into%20each%20group%E2%80%99s%20operations.%22%2C%22keywords%22%3A%22mobileiron%20log4shell%20exploitation%22%2C%22title%22%3A%22MobileIron%20Log4Shell%20Exploitation%20Survey%20%7C%20Forged%20in%20Fire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&pageViewId=e22dc2d8-3bd0-41ae-8f2c-7f31494340c0&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.100.252.97 Paris, France, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-100-252-97.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:19 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 18 Apr 2024 06:23:19 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 96ms
95ms Image
image/gif 95.100.252.97
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=9004e317-8e75-44e8-82af-80f70759447e&session=43f97038-6af2-4b73-8d6c-ca99f5f714c8&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2018%20Apr%202024%2006%3A23%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2018%20Apr%202024%2006%3A23%3A19%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223008%22%7D&isIframe=false&m=%7B%22description%22%3A%22MobileIron%20Log4Shell%20Exploitation.%20We%20examine%20the%20exploitation%20of%20MobileIron%20servers%20by%204%20unique%20adversaries%2C%20providing%20insight%20into%20each%20group%E2%80%99s%20operations.%22%2C%22keywords%22%3A%22mobileiron%20log4shell%20exploitation%22%2C%22title%22%3A%22MobileIron%20Log4Shell%20Exploitation%20Survey%20%7C%20Forged%20in%20Fire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fmobileiron-log4shell-exploitation&pageViewId=e22dc2d8-3bd0-41ae-8f2c-7f31494340c0&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.100.252.97 Paris, France, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-100-252-97.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.mandiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 18 Apr 2024 06:23:20 GMT
x-content-type-options: nosniff
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 18 Apr 2024 06:23:20 GMT

Verdicts & Comments Add Verdict or Comment

81 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

28 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mandiant.com/	1970-01-20 19:57:03	Name: __cf_bm Value: Z2.rYhxxEkuTdsHAi5yGnZ5LgScNY24wmNtooy60NIU-1713421396-1.0.1.1-IgM1.OpG1q8N.HdrTmg5eeCal5b0O3rup_fxEjKHc_8_UVS6NJRbcxEtppNlJYbpAc3dNz1.jW4LaBBHYs8Amg
.mandiant.com/	1969-12-31 23:59:59	Name: _cfuvid Value: ct7OsuCo0Pwnv4PPlumJxTiOO9az93hCrsj5Ipdhas4-1713421396003-0.0.1.1-604800000
.mandiant.com/	1970-01-20 22:06:37	Name: _gcl_au Value: 1.1.253309248.1713421397
.mandiant.com/	1970-01-20 19:58:27	Name: _gid Value: GA1.2.1498624105.1713421397
.mandiant.com/	1970-01-20 19:57:01	Name: _dc_gtm_UA-203244293-1 Value: 1
.t.co/	1970-01-21 05:33:01	Name: muc_ads Value: af3ca829-a27c-496d-b65a-b7b79bd6864f
.twitter.com/	1970-01-21 05:33:01	Name: personalization_id Value: "v1_2K8jCwOMHmNNVL8ObVSyZg=="
.linkedin.com/	1970-01-20 22:06:37	Name: li_sugr Value: 6300136d-bae5-46db-84a2-6f6f5cbaf68f
.linkedin.com/	1970-01-21 04:42:37	Name: bcookie Value: "v=2&fe845095-7629-4016-8784-a570dbf2a7d2"
.linkedin.com/	1970-01-20 19:58:27	Name: lidc Value: "b=VGST06:s=V:r=V:a=V:p=V:g=2953:u=1:x=1:i=1713421396:t=1713507796:v=2:sig=AQGx_8I5VRS2nhpe9wW1d_53Zrd2OPAh"
.mandiant.com/	1970-01-20 22:06:37	Name: _fbp Value: fb.1.1713421396908.403658966
.linkedin.com/	1970-01-20 20:40:13	Name: UserMatchHistory Value: AQJLmdWIExqTPAAAAY7v36uW_WEyxj9qoM5wRU92YEOVSUOeGyt-o5HnWGZrIBCP7TmqdmFFlK8w3g
.linkedin.com/	1970-01-20 20:40:13	Name: AnalyticsSyncHistory Value: AQI5EsZPzFtREQAAAY7v36uXD-eeDSk9jo9yNlqUPTzQ8Yzz3JDTnhn-4JC3WJENPk0jWcTm9PRfKLI9_IsHjQ
www.mandiant.com/	1970-01-20 20:07:06	Name: slireg Value: https://scout.us3.salesloft.com
.mandiant.com/	1970-01-21 04:42:37	Name: _hjSessionUser_3008912 Value: eyJpZCI6Ijk5M2IxZGFkLTk0ZDAtNTI4ZC1hMjA2LTZjNDIyZWZkYzMyNSIsImNyZWF0ZWQiOjE3MTM0MjEzOTcwNzQsImV4aXN0aW5nIjpmYWxzZX0=
.mandiant.com/	1970-01-20 19:57:03	Name: _hjSession_3008912 Value: eyJpZCI6ImNjYTFmMTMyLTJlNzUtNGU0Ny04N2NlLTcyNjg1ZjJjMDg3NiIsImMiOjE3MTM0MjEzOTcwNzYsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
.mandiant.com/	1970-01-20 19:58:27	Name: _uetsid Value: 24bf2480fd4c11ee9de63377c1e578a4
.mandiant.com/	1970-01-21 05:18:37	Name: _uetvid Value: 24bf4c00fd4c11ee8fa7773023135878
.www.linkedin.com/	1970-01-21 04:42:37	Name: bscookie Value: "v=1&2024041806231758e185a6-4d23-4be1-8791-ef5d1f60861dAQFOyr06FqeY64GH4uzhFVSkctGX3AxV"
.linkedin.com/	1970-01-21 00:16:13	Name: li_gc Value: MTswOzE3MTM0MjEzOTc7MjswMjGBfNRaGRKFF7c+Gd7+CNuOK7ViC0YGwcVO8Tf5NRpBmQ==
.bing.com/	1970-01-21 05:18:37	Name: MUID Value: 139B1698B371625C21E002FDB2DD634E
www.mandiant.com/	1970-01-21 04:42:37	Name: sliguid Value: c0d8a711-5b49-48ac-861e-5efd6a958708
www.mandiant.com/	1970-01-21 04:42:37	Name: slirequested Value: true
.mandiant.com/	1970-01-21 05:33:01	Name: _mkto_trk Value: id:565-PEI-952&token:_mch-mandiant.com-1713421397414-19929
.mandiant.com/	1970-01-21 05:33:01	Name: _ga Value: GA1.2.208561041.1713421397
.mandiant.com/	1970-01-21 05:33:01	Name: _ga_X6642ZTDJ7 Value: GS1.1.1713421396.1.0.1713421397.59.0.0
www.mandiant.com/	1970-01-21 05:33:01	Name: _gd_visitor Value: 9004e317-8e75-44e8-82af-80f70759447e
www.mandiant.com/	1970-01-20 19:57:15	Name: _gd_session Value: 43f97038-6af2-4b73-8d6c-ca99f5f714c8

39 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/880805232811859?v=2.9.154&r=stable&domain=www.mandiant.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105(Line 97) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

565-pei-952.mktoresp.com
analytics.twitter.com
b.6sc.co
bat.bing.com
c.6sc.co
cdn4.iconfinder.com
cdnjs.cloudflare.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
ipv6.6sc.co
j.6sc.co
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
scout-cdn.salesloft.com
scout.salesloft.com
script.hotjar.com
snap.licdn.com
static.addtoany.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
vc.hotjar.io
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.mandiant.com
104.244.42.195
104.244.42.5
104.69.156.245
13.107.42.14
13.32.27.19
146.75.120.157
18.66.102.106
18.66.112.110
192.28.144.124
2001:4860:4802:32::36
2606:4700:10::6816:47c5
2606:4700:10::ac43:2794
2606:4700:300b::a29f:f07d
2606:4700:3108::ac42:2ad3
2606:4700::6810:4869
2606:4700::6811:180e
2620:1ec:21::14
2620:1ec:c11::237
2a00:1450:4001:80b::200e
2a00:1450:4001:811::2003
2a00:1450:4001:812::200a
2a00:1450:4001:828::2004
2a00:1450:4001:831::2003
2a00:1450:4001:831::2008
2a00:1450:400c:c00::9c
2a02:26f0:7100::1720:ef19
2a02:26f0:7100::210:172
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
54.227.174.173
95.100.252.97
0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4
0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379
143f4d7f6d2c5abca7590a6dec282876ef49bc849c886fc7eefbfe3e1c6706fd
1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d
1cfea949b0b2925d27b84d56d18f2ea1c6b948fdf3ae95c534a14706043da178
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
201492c149f68b701455a2d046549a318a76ed5bca4ab13ebd913dbd14710246
27fe50b71088d1f9f47df0854172b86b379619e70cd372188a6c77afb7016ebb
3245f6cb8d40eebea048a60b056d9a48cbc3e1b0309a0a4cb0e51280f6b0c712
34e89fde702aa592d82afbb8d98034150cb3a2e6bd67a922af1edd106cf87fe8
3958a93184f498eaa140c746fa8b3ce7e540d38898f2b1c1acf9c7e8f6c5f429
40c1436cb0e94370dee18db4f09e3eb8e199713919adb33295536e6c26d9b74d
41d8731c789eeefe8cfc070d37c21cf501f733c1fd736d94772b2f0d7b46a610
4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440
4cfceab64cbab69a2c2cd656b4cfc2e1b749cfa45aa234834c4129b6ca64624d
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4fa7ca84dc3a040c7199206d3554b4b57d6cbb5c49ef435f674103587640d26a
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
54c80c16822515c155d73ba0189681e678eacc8e7a3ab0aff9d164f027d7216a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
591ec898579fc34d46d85f9b22fa8fcfa88465454caa0d86d03e9e6dc0675f9b
5b7ce7007d8d2b26888d2e3296348c5b603fe5fef938221fd1c9f217e9804af8
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621
6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984
6e0cc78c402cbc02fdfd41cd77c5fd6ffbd8066cc07935ea8eb5f3fcc59744a3
7762b4265e6050c33745fd1fae5110f9f265564f0a85d9ac01efaa65029db59c
7a1a28e26e577545cac3166880d39b6188156245e5d4b532f559be34ef1476f2
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8300ba70904617a47a80e9098fe00b3f7aefd328519318c420289b0bbdfb5e2c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84abbb88240359c728c738ec4acb83fc354afd75d7470279f1fe01f9841e5f4b
85f407912384186334577f65bf6bb88045bd96f5222d7c696cc71303d65c826a
91b9b24f0aa59668e4d0a770ee7a294b9baa361a76a20ade8128cd0482a5d805
9594dcb99d8233eb3d6ed0dc94af3b6c14c7a573374fe67c2b0b0b2cdf6d7a00
9bb6b31d6ee3cf33b3bb0f720ebac0c09b3e95023b4c0815b0216c271efb4d7c
9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e
a2db647fd13ef2dabd1b5cb75dd6c7b7e307bcfedb1811061e6ce7dc9e2bd58f
a9b7a66985bebc105b4b12f2f466fae88b9b16fe17ea5bc1d515753258a0be19
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acb33e5d72259c82bef8f6d6ddfc56bbdf4130739d3271a437b4d0065c390d9a
aefc3ff4ae77239cdef2fb5bda5b6e561e186270a8ecbf8b525c1deb55d12b8a
b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24
b5b5fd289870f9c111d2f32e53d5d220becac55773f34da6196dd04224eaa1e9
b64c5f7f0d453e3f4c48ce0dbf598d23362bcc6cfc405bc105bcbe7d2609cf20
be2a5e50e8dda09c9ccb17f0fce9143199ec092d05a2c418b47ef6cda5cda280
c9e6dccfd5d4a5d9290b9d4b7e833a5bf73fe58d82beb987296b64230e0d53da
ce56dc3783735b873af61135d410e3ccec9dfd565a5961fd707e85d1d6b654af
cfbbb6a8bb9482b6bddbba133d70d9ac28fea886ede20ecdaf3110d5c70dba6c
d7f62ccd6d9784466fb9b92202b71a63182de790d0575e13641e027b39e0590e
d8885f82460cd5977ef2f391c02cad23cd0262b3d9ec42c4aa92a1ecad0bf461
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df4d1ff8adb72502d1b262d0a8af4c3c902ff5e37e442861f5a9fed51d75d18f
dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9474894bf64b11c40884f83b0ba6888635bf90bfaae11db1944d99771f1c820
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f
f3212d7385c327317abf55280e4e949368eeda26977bbed7761a5a22fc2e2202
f8914b020e2c78fe86ca14198095455139f08047b8b52ab69003cb5af35cbbc0
fa8523773ec663ec32c3612167a9b2b5b1aeb047314d95dd9923b1ad9e0c489a
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6
ff46ab88d5fe2880ee24e0a56c4f423096ea4eb7b80e0fc8032319e26b5a002b

www.mandiant.com Open in urlscan Pro 2606:4700:300b::a29f:f07d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

86 Requests

99 %HTTPS

65 %IPv6

25 Domains

34 Subdomains

31 IPs

5 Countries

2038 kBTransfer

4807 kBSize

28 Cookies

34 Outgoing links

Redirected requests

86 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.mandiant.com Open in urlscan Pro
2606:4700:300b::a29f:f07d Public Scan

Screenshot
Live screenshot

Full Image

86
Requests

99 %
HTTPS

65 %
IPv6

25
Domains

34
Subdomains

31
IPs

5
Countries

2038 kB
Transfer

4807 kB
Size

28
Cookies

86 HTTP transactions
0 data transactions