www.fortinet.com Open in urlscan Pro
52.52.208.2 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c17275874...
Submission: On April 04 via api (April 4th 2020, 5:12:46 pm UTC) from US

Summary HTTP 66 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 36 IPs in 7 countries across 37 domains to perform 66 HTTP transactions. The main IP is 52.52.208.2, located in San Jose, United States and belongs to AMAZON-02, US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on January 22nd 2019. Valid for: 2 years.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	52.52.208.2 52.52.208.2	16509 (AMAZON-02) (AMAZON-02)
6	23.210.248.45 23.210.248.45	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:800::2008	15169 (GOOGLE) (GOOGLE)
1 4	52.50.37.223 52.50.37.223	16509 (AMAZON-02) (AMAZON-02)
3	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a00:1450:400... 2a00:1450:4001:817::200e	15169 (GOOGLE) (GOOGLE)
1	23.210.250.213 23.210.250.213	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.249.189.231 34.249.189.231	16509 (AMAZON-02) (AMAZON-02)
2	35.181.91.36 35.181.91.36	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1 6	23.210.248.216 23.210.248.216	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a02:26f0:f1:... 2a02:26f0:f1:29d::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.111.9.217 23.111.9.217	33438 (HIGHWINDS2) (HIGHWINDS2)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2a05:f500:11:... 2a05:f500:11:101::b93f:9001	14413 (LINKEDIN) (LINKEDIN)
15 18	52.215.109.198 52.215.109.198	16509 (AMAZON-02) (AMAZON-02)
2	50.17.52.222 50.17.52.222	14618 (AMAZON-AES) (AMAZON-AES)
3	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2 2	54.93.143.252 54.93.143.252	16509 (AMAZON-02) (AMAZON-02)
1 2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1 2	23.210.249.164 23.210.249.164	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	70.42.32.63 70.42.32.63	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	2a00:1288:f03... 2a00:1288:f03d:1fa::2000	10310 (YAHOO-1) (YAHOO-1)
1	151.101.13.44 151.101.13.44	54113 (FASTLY) (FASTLY)
1 2	3.127.164.217 3.127.164.217	16509 (AMAZON-02) (AMAZON-02)
1 2	54.93.38.91 54.93.38.91	16509 (AMAZON-02) (AMAZON-02)
1 2	185.33.220.145 185.33.220.145	29990 (ASN-APPNEX) (ASN-APPNEX)
1	35.190.72.21 35.190.72.21	15169 (GOOGLE) (GOOGLE)
1 2	34.95.120.147 34.95.120.147	15169 (GOOGLE) (GOOGLE)
2 2	172.217.22.98 172.217.22.98	15169 (GOOGLE) (GOOGLE)
1 3	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:818::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:4104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.216.76.92 52.216.76.92	16509 (AMAZON-02) (AMAZON-02)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1	2a03:2880:f01... 2a03:2880:f01c:8004:face:b00c:0:8c	32934 (FACEBOOK) (FACEBOOK)
66	36

10 52.52.208.2 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-52-208-2.us-west-1.compute.amazonaws.com

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.210.248.45 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-45.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.50.37.223 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-37-223.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.250.213 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-213.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.249.189.231 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-189-231.eu-west-1.compute.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.181.91.36 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-181-91-36.eu-west-3.compute.amazonaws.com

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.210.248.216 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-216.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:f1:29d::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.9.217 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.optmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:11:101::b93f:9001 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 52.215.109.198 (Dublin, Ireland) 15 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-109-198.eu-west-1.compute.amazonaws.com

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.17.52.222 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-17-52-222.compute-1.amazonaws.com

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.93.143.252 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-93-143-252.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.210.249.164 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-164.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 70.42.32.63 (United States) 1 redirects

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:f03d:1fa::2000 (United Kingdom) 1 redirects

ASN10310 (YAHOO-1, US)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.127.164.217 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-164-217.eu-central-1.compute.amazonaws.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.93.38.91 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-93-38-91.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.220.145 (Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.72.21 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 21.72.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.95.120.147 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 147.120.95.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.98 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s18-in-f98.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland) 1 redirects

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4104 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.216.76.92 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

optin-monster.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:8004:face:b00c:0:8c (Ireland)

ASN32934 (FACEBOOK, US)

cx.atdmt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	adroll.com 15 redirects s.adroll.com d.adroll.com	28 KB
12	fortinet.com www.fortinet.com metrics.fortinet.com	650 KB
6	adobedtm.com assets.adobedtm.com	68 KB
5	demdex.net 1 redirects dpm.demdex.net fortinet.demdex.net	3 KB
3	facebook.com 1 redirects www.facebook.com	573 B
3	yahoo.com 2 redirects ups.analytics.yahoo.com ads.yahoo.com	2 KB
3	facebook.net connect.facebook.net	255 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	2 KB
2	doubleclick.net 2 redirects cm.g.doubleclick.net	530 B
2	openx.net 1 redirects us-u.openx.net	359 B
2	adnxs.com 1 redirects ib.adnxs.com	2 KB
2	bidswitch.net 1 redirects x.bidswitch.net	907 B
2	3lift.com 1 redirects eb2.3lift.com	737 B
2	outbrain.com 1 redirects sync.outbrain.com	804 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com	2 KB
2	advertising.com 2 redirects pixel.advertising.com	818 B
2	omappapi.com api.omappapi.com	57 KB
2	licdn.com snap.licdn.com	4 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	addthis.com s7.addthis.com	189 KB
1	atdmt.com cx.atdmt.com	316 B
1	t.co t.co	171 B
1	twitter.com analytics.twitter.com	283 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	amazonaws.com optin-monster.s3.amazonaws.com	36 KB
1	cloudflare.com cdnjs.cloudflare.com	15 KB
1	googleapis.com ajax.googleapis.com	6 KB
1	rlcdn.com idsync.rlcdn.com	40 B
1	taboola.com trc.taboola.com	197 B
1	pubmatic.com simage2.pubmatic.com	886 B
1	rubiconproject.com pixel.rubiconproject.com	797 B
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	136 B
1	optmnstr.com a.optmnstr.com	59 KB
1	addthisedge.com v1.addthisedge.com	756 B
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	moatads.com z.moatads.com	1 KB
1	googletagmanager.com www.googletagmanager.com	35 KB
66	37

	Domain	Requested by
17	d.adroll.com	14 redirects www.fortinet.com
10	www.fortinet.com	www.fortinet.com
6	s.adroll.com	1 redirects www.googletagmanager.com www.fortinet.com s.adroll.com
6	assets.adobedtm.com	www.fortinet.com assets.adobedtm.com
4	dpm.demdex.net	1 redirects www.fortinet.com
3	www.facebook.com	1 redirects www.fortinet.com connect.facebook.net
3	connect.facebook.net	s.adroll.com connect.facebook.net
2	cm.g.doubleclick.net	2 redirects
2	us-u.openx.net	1 redirects www.fortinet.com
2	ib.adnxs.com	1 redirects www.fortinet.com
2	x.bidswitch.net	1 redirects www.fortinet.com
2	eb2.3lift.com	1 redirects www.fortinet.com
2	sync.outbrain.com	1 redirects www.fortinet.com
2	dsum-sec.casalemedia.com	1 redirects www.fortinet.com
2	ups.analytics.yahoo.com	1 redirects www.fortinet.com
2	pixel.advertising.com	2 redirects
2	api.omappapi.com	a.optmnstr.com
2	px.ads.linkedin.com	1 redirects www.fortinet.com
2	snap.licdn.com	www.googletagmanager.com www.fortinet.com
2	metrics.fortinet.com	assets.adobedtm.com www.fortinet.com
2	www.google-analytics.com	www.googletagmanager.com www.fortinet.com
2	s7.addthis.com	assets.adobedtm.com s7.addthis.com
1	cx.atdmt.com
1	t.co
1	analytics.twitter.com	static.ads-twitter.com
1	static.ads-twitter.com	www.fortinet.com
1	optin-monster.s3.amazonaws.com	www.fortinet.com
1	cdnjs.cloudflare.com	a.optmnstr.com
1	ajax.googleapis.com	a.optmnstr.com
1	idsync.rlcdn.com	www.fortinet.com
1	trc.taboola.com	www.fortinet.com
1	ads.yahoo.com	1 redirects
1	simage2.pubmatic.com	www.fortinet.com
1	pixel.rubiconproject.com	www.fortinet.com
1	d.adroll.mgr.consensu.org	1 redirects
1	www.linkedin.com	1 redirects
1	a.optmnstr.com	www.googletagmanager.com
1	v1.addthisedge.com	s7.addthis.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	assets.adobedtm.com
1	z.moatads.com	s7.addthis.com
1	www.googletagmanager.com	www.fortinet.com
66	42

This site contains links to these domains. Also see Links.

Domain
fortiguard.com
attack.mitre.org
www.facebook.com
www.twitter.com
www.youtube.com
www.linkedin.com
www.instagram.com
secure.fortinet.com
fusecommunity.fortinet.com
cookie-script.com
www.addthis.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-22` - `2021-03-31`	2 years	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
odc-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2020-09-04`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
metrics.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-29` - `2021-02-02`	2 years	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.optmnstr.com Go Daddy Secure Certificate Authority - G2	`2018-07-10` - `2020-07-10`	2 years	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-03-04` - `2020-09-04`	6 months	crt.sh
adroll.mgr.consensu.org Amazon	`2019-11-06` - `2020-12-06`	a year	crt.sh
*.omappapi.com Go Daddy Secure Certificate Authority - G2	`2020-03-16` - `2022-03-16`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-03-01` - `2020-05-30`	3 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-02-13` - `2020-08-11`	6 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.outbrain.com Thawte RSA CA 2018	`2019-10-29` - `2021-11-23`	2 years	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.taboola.com DigiCert SHA2 Secure Server CA	`2020-02-19` - `2020-09-10`	7 months	crt.sh
*.3lift.com Amazon	`2019-07-17` - `2020-08-17`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2019-04-17` - `2020-05-04`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-04-24` - `2020-04-23`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2018-01-04` - `2020-07-09`	3 years	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-12-05` - `2020-06-12`	6 months	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2019-11-09` - `2021-03-12`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.atlassolutions.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2020-06-03`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Frame ID: 970AAF462E1FB73947268091D5E78B3A
Requests: 68 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: C5A43E752AD5B5759FDF6F16D0358F85
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /(?:a|s)\.adroll\.com/i

Adobe DTM (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/assets.adobedtm.com\//i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Page Statistics

66
Requests

100 %
HTTPS

28 %
IPv6

37
Domains

42
Subdomains

36
IPs

7
Countries

1426 kB
Transfer

4001 kB
Size

18
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/software/S0331
Title: Agent Tesla

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/SecureNetworks
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/behindthefirewall/
Title:

Search URL Search Domain Scan URL

URL: https://secure.fortinet.com/fortiguard
Title: Threat Briefs

Search URL Search Domain Scan URL

URL: https://fusecommunity.fortinet.com/
Title: Fuse

Search URL Search Domain Scan URL

URL: https://cookie-script.com/
Title: Free cookie consent by cookie-script.com

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://dpm.demdex.net/id?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1586020348647 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1586020348647

Request Chain 18

https://cm.everesttech.net/cm/dd?d_uuid=25243660902302517713837843772327520838 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xoi--AAAAZ1awi3-

Request Chain 28

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&time=1586020348802 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fnew-agent-tesla-variant-spreading-by-phishing.html%253FelqTrackId%253Da835c172758745c8ad75bc94290a7a06%2526elq%253De318f22a1fad489b9ecc8cfb005633da%2526elqaid%253D19731%2526elqat%253D1%2526elqCampaignId%253D14758%26time%3D1586020348802%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&time=1586020348802&liSync=true

Request Chain 31

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 33

https://d.adroll.mgr.consensu.org/consent/iabcheck/7OBVBCAQE5FHDPFEAD5T4D?_s=7e31fdbe19ee83e410985e7c11687d9f&_b=2 HTTP 302
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=7e31fdbe19ee83e410985e7c11687d9f&_b=2

Request Chain 35

https://d.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&pv=74396942395.25465&cookie=&adroll_s_ref=&keyw= HTTP 302
https://s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/RBXJKDWUZRBXZHBJURU5IH.js

Request Chain 38

https://d.adroll.com/cm/aol/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/55980/sync?uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP76a511bd-7697-11ea-a88b-0679da096730 HTTP 302
https://ups.analytics.yahoo.com/ups/55980/sync?uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP76a511bd-7697-11ea-a88b-0679da096730&verify=true

Request Chain 39

https://d.adroll.com/cm/index/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&expiration=1617556349 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&expiration=1617556349&C=1

Request Chain 40

https://d.adroll.com/cm/n/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&expires=365

Request Chain 41

https://d.adroll.com/cm/outbrain/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&rdrctExp=true

Request Chain 42

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA

Request Chain 43

https://d.adroll.com/cm/r/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
https://d.adroll.com/cm/r/in?xid=E0&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 44

https://d.adroll.com/cm/taboola/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ

Request Chain 45

https://d.adroll.com/cm/triplelift/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://eb2.3lift.com/xuid?mid=4714&xuid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&dongle=c85e HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

Request Chain 46

https://d.adroll.com/cm/b/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://x.bidswitch.net/sync?dsp_id=44&user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ

Request Chain 47

https://d.adroll.com/cm/x/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://ib.adnxs.com/setuid?entity=172&code=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ

Request Chain 48

https://d.adroll.com/cm/l/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://idsync.rlcdn.com/377928.gif?partner_uid=03f25043cdc73b24e749a8830f509dd4

Request Chain 49

https://d.adroll.com/cm/o/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537103138&val=03f25043cdc73b24e749a8830f509dd4 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=03f25043cdc73b24e749a8830f509dd4

Request Chain 50

https://d.adroll.com/cm/g/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&xid_ch=f&advertisable=7OBVBCAQE5FHDPFEAD5T4D&google_nid=adroll5 HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=A_JQQ83HOyTnSaiDD1Cd1A HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=A_JQQ83HOyTnSaiDD1Cd1A&google_tc= HTTP 302
https://d.adroll.com/cm/g/in

Request Chain 66

https://www.facebook.com/tr/?id=559328277756725&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&rl=&if=false&ts=1586020350083&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=30&fbp=fb.1.1586020349097.2039144316&it=1586020349049&coo=false&rqm=GET HTTP 302
https://cx.atdmt.com/?c=6636927192357580200&f=AYwoDkHeWDF7PjUNvh-ZmQrail2xoGFpMxZidAlDDsWEAb96sv7q6mLlNIvZIqWNWdfDEZ74UJL-MtR43zSNPaS1&id=559328277756725&l=3&v=0

66 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request new-agent-tesla-variant-spreading-by-phishing.html Show response
www.fortinet.com/blog/threat-research/ 59 KB
20 KB 177ms
176ms Document
text/html 52.52.208.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

4a1bd50c41da75d6e444c7da9812ad6d9f5f41e00b27a5bc570d5c6840f97cc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.fortinet.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=600, public
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Sat, 04 Apr 2020 17:12:28 GMT
ETag: "ed0b-5a279445c3b90-gzip"
Last-Modified: Sat, 04 Apr 2020 16:10:05 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
Content-Length: 20315
Connection: keep-alive

GET
H/1.1 200
OK clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 212 KB
26 KB 181ms
181ms Stylesheet
text/css 52.52.208.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

a55db6ce7f6660f8bd63293e801bf3ae471ca4335e5b465ec8c4b3116e3aa19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Sat, 04 Apr 2020 17:12:28 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Length: 25637
Last-Modified: Wed, 19 Feb 2020 19:25:59 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "35154-59ef2c2153fc0-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/css;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 203 KB
52 KB 34ms
33ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3fcd447726350779a15c76241650b91e4932c1a064a7ddd508cdcaf40d2b7db5

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:28 GMT
content-encoding: gzip
last-modified: Fri, 03 Apr 2020 17:50:54 GMT
server: AkamaiNetStorage
etag: "90d9d1d47299da335a4cceb63d6d350b:1585936254.177028"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 04 Apr 2020 18:12:28 GMT

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 179ms
179ms Image
image/svg+xml 52.52.208.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Sat, 04 Apr 2020 17:12:28 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Length: 1998
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "7ebb-565d53a1d6e40-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/svg+xml
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H/1.1 200
OK clientlib-base.min.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 165 KB
75 KB 187ms
186ms Script
application/javascript 52.52.208.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

ad979cd8209daf4934baefa31ec4dede21ae9cc233cf809da2ed5ed839f03a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Sat, 04 Apr 2020 17:12:28 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
content-length: 76083
Last-Modified: Mon, 23 Sep 2019 20:57:02 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "29256-5933ea9592380-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 101 KB
35 KB 17ms
16ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e717cb376f9160bc32d1cff24effc117c256426184e0d55727ed04fd86f779d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:28 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35661
x-xss-protection: 0
last-modified: Sat, 04 Apr 2020 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 04 Apr 2020 17:12:28 GMT

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

302
Found

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1586020348647
https://dpm.demdex.net/id/rd?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1586020348647

0
-1 B

44ms
44ms

XHR

52.50.37.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1586020348647

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.50.37.223 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-50-37-223.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://dpm.demdex.net/id/rd?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1586020348647
X-TID: 3WAVUaZyTeQ=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.fortinet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://www.fortinet.com
X-TID: 3WAVUaZyTeQ=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1586020348647
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP308220a2a4c4403f97fc1960100db40f/ 36 KB
13 KB 26ms
26ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP308220a2a4c4403f97fc1960100db40f/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: adfcb165c69213b0aba3c64bc549f7ff156ec82110fb8ef144b1d16ebc13b04a

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:28 GMT
content-encoding: gzip
last-modified: Tue, 10 Mar 2020 22:29:22 GMT
server: AkamaiNetStorage
etag: "42fa244f36955eedb3cd8ade6f492bf6:1583879362.816163"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 13342
expires: Sat, 04 Apr 2020 18:12:28 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 349 KB
113 KB 32ms
32ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Tue, 21 Jan 2020 20:57:37 GMT
server: nginx/1.15.8
etag: "5e2765c1-57446"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Sat, 04 Apr 2020 17:12:28 GMT
x-host: s7.addthis.com
content-length: 114924

GET
H/1.1 200
OK Picture6.png
www.fortinet.com/content/dam/fortinet-blog/article-images/new-agent-tesla-blog/ 198 KB
199 KB 174ms
173ms Image
image/png 52.52.208.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/new-agent-tesla-blog/Picture6.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

7934063bb44880cb75fee170a559b2350ff23454f8ec01dec4b8e75f667a174c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Sat, 04 Apr 2020 17:12:28 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 31 Mar 2020 22:14:37 GMT
Server: Apache
ETag: "3196e-5a22de4a80d40"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 203118

GET
H/1.1 200
OK adobe-vuln-img.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/adobe-threat-blogg/ 35 KB
35 KB 179ms
178ms Image
image/png 52.52.208.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/adobe-threat-blogg/adobe-vuln-img.png.thumb.319.319.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

4687e8b612d5c3d2474cfbd116a3897f3c7355c62e48614a78acbbf269938d09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Sat, 04 Apr 2020 17:12:28 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 23 Mar 2020 23:36:14 GMT
Server: Apache
ETag: "8b8f-5a18e19cf5780"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 35727

GET
H/1.1 200
OK Picture2.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/cve-windows-smb/ 20 KB
20 KB 178ms
178ms Image
image/png 52.52.208.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/cve-windows-smb/Picture2.png.thumb.319.319.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d0e9155073e7ffd98c57ebe40523d6f99edb803473c42477c2ef54dbbd0218d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Sat, 04 Apr 2020 17:12:28 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 09 Mar 2020 23:30:00 GMT
Server: Apache
ETag: "4f8b-5a07461bd4e00"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 20363

GET
H/1.1 200
OK Picture5.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/trickbot-word-document/ 49 KB
50 KB 176ms
176ms Image
image/png 52.52.208.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/trickbot-word-document/Picture5.png.thumb.319.319.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

df6309120d0e89c7ab6ca5f5e0f300db33d8a930381a88ac54bb47cf603873c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Sat, 04 Apr 2020 17:12:28 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 09 Mar 2020 16:15:34 GMT
Server: Apache
ETag: "c4a1-5a06e5015b580"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 50337

GET
H/1.1 200
OK rd Show response
dpm.demdex.net/id/ 367 B
1 KB 46ms
45ms XHR
application/json 52.50.37.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1586020348647

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.50.37.223 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-50-37-223.eu-west-1.compute.amazonaws.com

Software

Resource Hash

533f36b8be9917035e75d975c0f6962ccb33808f1f4cd04cfddd181e28b4edd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Origin: https://www.fortinet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v064-00b2e8be5.edge-irl1.demdex.com 5.66.0.20200310121811 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: s97ose3aQP8=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.fortinet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 299
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 2033
date: Sat, 04 Apr 2020 16:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Sat, 04 Apr 2020 18:38:35 GMT

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 26ms
26ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:28 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: FBAF69B7861DE212
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=18191
accept-ranges: bytes
content-length: 948
x-amz-id-2: mINJDBnKUfP83RzDJ6hQaYSGPvMPOM770jd+gXVSD8LFScfPdVPaVzI4W2IwmrtEKhDna93Nv9A=

GET
H/1.1 200
OK Cookie set dest5.html
fortinet.demdex.net/ Frame C5A4 0
0 44ms
43ms Document
text/html 34.249.189.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.189.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-189-231.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: fortinet.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=25243660902302517713837843772327520838
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 18 Mar 2020 14:20:07 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=25243660902302517713837843772327520838;Path=/;Domain=.demdex.net;Expires=Thu, 01-Oct-2020 17:12:28 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: PL1lPW1ITFo=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
metrics.fortinet.com/ 48 B
484 B 73ms
26ms XHR
application/x-javascript 35.181.91.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.fortinet.com/id?d_visid_ver=4.5.2&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=25621210838653587073874468468281887694&ts=1586020348747

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.91.36 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-91-36.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

af3459ac72572ffd822a1ebc21101b8749a111cf0e1948f419caed74286557dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Origin: https://www.fortinet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Sat, 04 Apr 2020 17:12:28 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-544845747d-rwtrh
vary: Origin
x-c: master-1219.Ia2cf62.M0-374
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Xoi--AAAAZ1awi3-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=25243660902302517713837843772327520838
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xoi--AAAAZ1awi3-

42 B
915 B

44ms
43ms

Image
image/gif

52.50.37.223
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xoi--AAAAZ1awi3-

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.50.37.223 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-50-37-223.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v064-0e19bbd92.edge-irl1.demdex.com 5.66.0.20200310121811 1ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: oWyCfNSGS1I=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Sat, 04 Apr 2020 17:12:28 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xoi--AAAAZ1awi3-
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
111 B 13ms
13ms Image
image/gif 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=558157775&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&ul=en-us&de=UTF-8&dt=New%20Agent%20Tesla%20Variant%20Spreading%20by%20Phishing&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAAAB~&jid=224846465&gjid=1150164945&cid=776377828.1586020349&tid=UA-767980-6&_gid=1752106668.1586020349&_r=1&gtm=2wg3p1NBSLLPJ&z=2057097885

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 RCb652faf409a54c3db318899e2cbcc95c-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2b441d8e9bf/ 881 B
697 B 27ms
27ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2b441d8e9bf/RCb652faf409a54c3db318899e2cbcc95c-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a0cda6180b83b4f2c51e115d8edfaf4eb0fe16ab2514e8bf6f718ed3f1cff758

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:28 GMT
content-encoding: gzip
last-modified: Fri, 03 Apr 2020 17:50:55 GMT
server: AkamaiNetStorage
etag: "ac46e4cbc68ef5eae60bb02f25b8d192:1585936255.360317"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 452
expires: Sat, 04 Apr 2020 18:12:28 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/ 2 KB
756 B 42ms
42ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:28 GMT
content-encoding: gzip
etag: 1861047380--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=16, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 580

GET
H/1.1 200
OK catch58f9.png
www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing/_jcr_content/root/responsivegrid/image_1795375936.img.png/1585753602590/ 192 KB
193 KB 173ms
173ms Image
image/png 52.52.208.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing/_jcr_content/root/responsivegrid/image_1795375936.img.png/1585753602590/catch58f9.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

11b05d9614b7dd97a53463d7d9a275c325431bf0d01af420f8a4d43e7174dde8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Sat, 04 Apr 2020 17:12:28 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 01 Apr 2020 15:06:42 GMT
Server: Apache
ETag: "3019b-5a23c08260480"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Content-Disposition: inline; filename=catch58f9.png
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 197019

GET
H/1.1 200
OK picture2.png
www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing/_jcr_content/root/responsivegrid/image_489158878.img.png/1585695914491/ 28 KB
28 KB 179ms
179ms Image
image/png 52.52.208.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing/_jcr_content/root/responsivegrid/image_489158878.img.png/1585695914491/picture2.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

52.52.208.2 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-52-208-2.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

baad6870255b11b5a30e851c6e4e2d16a50201c8dd3589157cb1b4e96557e52d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Sat, 04 Apr 2020 17:12:28 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 31 Mar 2020 23:05:14 GMT
Server: Apache
ETag: "6f80-5a22e99acfe80"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Content-Disposition: inline; filename=picture2.png
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 28544

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 34 KB
11 KB 31ms
30ms Script
text/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 19c904aaa555d91d75c5b3682e3f358ba5af4c302339d63c9e464f53d8708ff8

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: EEryoP57M4BXSHtGt9JFNoNG_YhGzXxp
Content-Encoding: gzip
x-amz-request-id: 5B64FB7E0A29A18E
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Sat, 04 Apr 2020 17:12:28 GMT
Connection: keep-alive
Content-Length: 10905
x-amz-id-2: cyhtZzUMRRH+3azNobhgA/owi1TOIrHigGwio+Vd/0CCKLcw4WcCHJh++0vWdWKuZdO/e9F4VUU=
Last-Modified: Wed, 01 Apr 2020 18:03:06 GMT
Server: AmazonS3
ETag: "9884704eb3fc99427eb5b90c4bbab62c"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 7ms
7ms Script
application/x-javascript 2a02:26f0:f1:29d::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f1:29d::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sat, 04 Apr 2020 17:12:28 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=32490
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 api.min.js Show response
a.optmnstr.com/app/js/ 198 KB
59 KB 23ms
22ms Script
application/javascript 23.111.9.217
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.optmnstr.com/app/js/api.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5723c9474d9e82996e314a3f818c958e3e86c9ce4656d8cdfed490f4a5df89f1

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:28 GMT
content-encoding: gzip
last-modified: Fri, 03 Apr 2020 19:24:19 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 6F620189D5EB79EB
etag: W/"0b0e78a87aaae61eb57072204ac8b607"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: VVxpDQselIBm+Nm+TcBVa7GeNMJ3AZ0aBJww4ZyzxdRjpC55lEN/6iqMGdU6jiO4gGxP/odZgpI=
expires: Tue, 30 Mar 2021 17:12:28 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c17275874...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%25...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c17275874...

0
284 B

110ms
110ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&time=1586020348802&liSync=true
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 04 Apr 2020 17:12:29 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
server: Play
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: YFQUthqtAhbA2gD5nysAAA==

Redirect headers

date: Sat, 04 Apr 2020 17:12:28 GMT
x-content-type-options: nosniff
linkedin-action: 1
status: 302
strict-transport-security: max-age=2592000
content-length: 0
x-li-uuid: 7ahBsBqtAhYA0bN0QCsAAA==
server: Play
pragma: no-cache
x-li-pop: prod-tln1
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&time=1586020348802&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 layers.ab5cd98fe1b9a38a4a9f.js Show response
s7.addthis.com/static/ 263 KB
76 KB 35ms
35ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Wed, 18 Sep 2019 14:16:17 GMT
server: nginx/1.15.8
etag: W/"5d823c31-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Sat, 04 Apr 2020 17:12:28 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77528

GET
H2 200 s35146098673970
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.20.0-LAR3/ 43 B
626 B 25ms
24ms Image
image/gif 35.181.91.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.20.0-LAR3/s35146098673970?AQB=1&ndh=1&pf=1&t=4%2F3%2F2020%2019%3A12%3A28%206%20-120&mid=25621210838653587073874468468281887694&aamlh=6&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Anew-agent-tesla-variant-spreading-by-phishing%3Aelqtrackid%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqcampaignid%3D14758&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&cc=USD&events=event3&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3Felqtrackid%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqcampaignid%3D14758&v3=%2B1&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Anew-agent-tesla-variant-spreading-by-phishing%3Aelqtrackid%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqcampaignid%3D14758&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.91.36 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-91-36.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 17:12:28 GMT
x-content-type-options: nosniff
x-c: master-1219.Ia2cf62.M0-374
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sun, 05 Apr 2020 17:12:28 GMT
server: jag
xserver: anedge-544845747d-2479g
etag: 3405952762810564608-4613563204305359249
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Fri, 03 Apr 2020 17:12:28 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js
https://s.adroll.com/j/exp/index.js

28 B
747 B

26ms
26ms

Script
application/javascript

23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: oJIzvk_mmLAXF5iekxvT5NnrQtQSmq7M
Content-Encoding: gzip
x-amz-request-id: CC0F73FCFF952524
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Sat, 04 Apr 2020 17:12:29 GMT
Connection: keep-alive
Content-Length: 48
x-amz-id-2: l2SuY/Zqhw+xyJkj7InfvqoJzNpqh9IGnRBj0DT2XibyJ/lFEH5SE9WbzHsCVnMaz+lknVzoYg8=
Last-Modified: Thu, 02 Apr 2020 22:43:50 GMT
Server: AmazonS3
ETag: "5816cced8568d223aa09d889f300692b"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Sat, 04 Apr 2020 17:12:29 GMT
Server: AkamaiGHost
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/ 1 KB
1 KB 26ms
26ms Script
text/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: FMSKiKs.nWxrDc7PHJBH4sZiN6xG4w7g
Content-Encoding: gzip
x-amz-request-id: 00F65CAD7182CC88
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Sat, 04 Apr 2020 17:12:28 GMT
Connection: keep-alive
Content-Length: 635
x-amz-id-2: VU/xI6J3FNO3kb+c00ntRlh6uWxQYMratHJ5j8Y2ju1bTZ2k+cawW0YheleMXlCPd3NNu8iXuWI=
Last-Modified: Sat, 04 Apr 2020 12:12:49 GMT
Server: AmazonS3
ETag: "3996d65282dd996ee0d7d4c90c139158"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

/ Show response
d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/7OBVBCAQE5FHDPFEAD5T4D?_s=7e31fdbe19ee83e410985e7c11687d9f&_b=2
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=7e31fdbe19ee83e410985e7c11687d9f&_b=2

107 B
575 B

43ms
43ms

Script
application/javascript

52.215.109.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=7e31fdbe19ee83e410985e7c11687d9f&_b=2
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.109.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-109-198.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 7a19ff8cb29bb3eb64c4629650f09dd2f2fa5a96983bc14b2e099ec7223c26ca

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:28 GMT
server: nginx/1.16.1
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 200
cache-control: no-store, no-cache, must-revalidate
content-type: application/javascript
content-length: 107

Redirect headers

status: 302
date: Sat, 04 Apr 2020 17:12:28 GMT
server: nginx/1.16.1
content-length: 105
location: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=7e31fdbe19ee83e410985e7c11687d9f&_b=2

GET
H2 200 39852 Show response
api.omappapi.com/v2/embed/ 639 KB
57 KB 450ms
218ms XHR
application/json 50.17.52.222
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852
Requested by: Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.17.52.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-52-222.compute-1.amazonaws.com
Software: Pagely Gateway/1.5.1 /
Resource Hash: 55b80a833d7a1674b2cf54418d98b05801670607c99eacc333d79ed4c969a7cb

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Origin: https://www.fortinet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-user-agent: standard
content-encoding: gzip
x-cache-config: 0 0
server: Pagely Gateway/1.5.1
status: 200
date: Sat, 04 Apr 2020 17:12:29 GMT
x-cache-status: HIT
vary: Accept-Encoding, User-Agent
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-OptinMonster-Account
access-control-allow-headers: X-CSRF-Token
x-optinmonster-account: 45602

GET
H/1.1

200
OK

RBXJKDWUZRBXZHBJURU5IH.js Show response
s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/
Redirect Chain

https://d.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fn...
https://s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/RBXJKDWUZRBXZHBJURU5IH.js

5 KB
2 KB

27ms
27ms

Script
text/javascript

23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/RBXJKDWUZRBXZHBJURU5IH.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: aa50be672f4a9019b33642489eed7731ad0cb5a7a68269ecb8c076b2fa213f4a

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: jukH5qaaqmEM0oAzxD2rsIayZtUAvCrP
Content-Encoding: gzip
x-amz-request-id: 21ADCF94248DFF77
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Sat, 04 Apr 2020 17:12:29 GMT
Connection: keep-alive
Content-Length: 1764
x-amz-id-2: BUNg7iQgtVN1gehz4mnq+hSPl/Wh9he/BB5C6vHOyF6x+5R302YMiI82Qmso1wgHSecxapKZxPM=
Last-Modified: Tue, 04 Feb 2020 23:14:39 GMT
Server: AmazonS3
ETag: "2c93f00d29e9c2730ecc172f493213f9"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

date: Sat, 04 Apr 2020 17:12:28 GMT
x-segment-display-name: Fortinet site visitors
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 302
content-length: 0
pragma: no-cache
x-conversion-value: 0.00
server: nginx/1.16.1
x-rule: *fortinet.com*
x-segment-eid: RBXJKDWUZRBXZHBJURU5IH
location: https://s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/RBXJKDWUZRBXZHBJURU5IH.js
cache-control: no-store, no-cache, must-revalidate
x-pixel-eid: GIVUJ77KRNF4LOPGYJ6RS5
x-segment-name: 311cc506
x-advertisable-eid: 7OBVBCAQE5FHDPFEAD5T4D
x-conversion-currency

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 126 KB
30 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: s.adroll.com
URL: https://s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/RBXJKDWUZRBXZHBJURU5IH.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: 3B739OopT6ZsqKptY+kkPT6Fh5xGedpqjD6VdCPMB41a0nhpVd+c+5k2+L+ZKjq+YhgZUWgtajYlpeWTggrMPw==
x-fb-trip-id: 420120009
date: Sat, 04 Apr 2020 17:12:29 GMT, Sat, 04 Apr 2020 17:12:29 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK sendrolling.js Show response
s.adroll.com/j/ 9 KB
3 KB 26ms
26ms Script
text/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/sendrolling.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/pixel/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/RBXJKDWUZRBXZHBJURU5IH.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1bdbcee5cd776cb671f72362db4be8dde833057b8e8f816c86fd301896652c8d

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: NM.EHVfGEDu2TYFqb1osrv1zRII373EC
Content-Encoding: gzip
x-amz-request-id: E2F067B4E9F95C64
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Sat, 04 Apr 2020 17:12:29 GMT
Connection: keep-alive
Content-Length: 2039
x-amz-id-2: zahNXUrZcHvPMHZ5OZzeA/pmU+ThIaY+/c27IjCJ/f8DH693VdK16PYXiwNkUgRleJPaNozozcA=
Last-Modified: Mon, 03 Feb 2020 20:32:06 GMT
Server: AmazonS3
ETag: "15441b08d0c4f93b1dd5f533cd361cd8"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55980/
Redirect Chain

https://d.adroll.com/cm/aol/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phish...
https://pixel.advertising.com/ups/55980/sync?uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
https://pixel.advertising.com/ups/55980/sync?uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
https://ups.analytics.yahoo.com/ups/55980/sync?uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP76a511bd-7697-11ea-a88b-06...
https://ups.analytics.yahoo.com/ups/55980/sync?uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP76a511bd-7697-11ea-a88b-06...

0
977 B

24ms
23ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55980/sync?uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP76a511bd-7697-11ea-a88b-0679da096730&verify=true

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.106 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 04 Apr 2020 17:12:29 GMT
Server: ATS/7.1.2.106
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Date: Sat, 04 Apr 2020 17:12:29 GMT
Server: ATS/7.1.2.106
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://ups.analytics.yahoo.com/ups/55980/sync?uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&_origin=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP76a511bd-7697-11ea-a88b-0679da096730&verify=true
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://d.adroll.com/cm/index/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phi...
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&expiration=1617556349
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&expiration=1617556349&C=1

43 B
1003 B

36ms
36ms

Image
image/gif

23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&expiration=1617556349&C=1
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 04 Apr 2020 17:12:29 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 04 Apr 2020 17:12:29 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 04 Apr 2020 17:12:29 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&expiration=1617556349&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 333
Expires: Sat, 04 Apr 2020 17:12:29 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://d.adroll.com/cm/n/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishin...
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&expires=365

42 B
797 B

110ms
30ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&expires=365
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: image/gif
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:29 GMT
server: nginx/1.16.1
location: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&expires=365
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 302
cache-control: no-store, no-cache, must-revalidate
content-length: 124

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/
Redirect Chain

https://d.adroll.com/cm/outbrain/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-...
https://sync.outbrain.com/cookie-sync?p=adroll&uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ
https://sync.outbrain.com/cookie-sync?p=adroll&uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&rdrctExp=true

0
450 B

109ms
109ms

Image
text/plain

70.42.32.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=adroll&uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&rdrctExp=true
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.63 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-TraceId: 27523743ef93faf737ca6d673a134e39
Date: Sat, 04 Apr 2020 17:12:29 GMT
Content-Length: 0

Redirect headers

Location: https://sync.outbrain.com/cookie-sync?p=adroll&uid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&rdrctExp=true
Date: Sat, 04 Apr 2020 17:12:29 GMT
X-TraceId: 49750ecf11b225334398f801e2ff4a23
Content-Length: 0

GET
H/1.1

200
OK

Pug
simage2.pubmatic.com/AdServer/
Redirect Chain

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENA...

1 B
886 B

25ms
24ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 04 Apr 2020 17:12:29 GMT
X-lat: Pug22064:0:302
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
Cache-Control: no-store, no-cache, private
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
X-Cnection: close
Content-Type: text/html; charset=utf-8
Content-Length: 1

Redirect headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:29 GMT
server: nginx/1.16.1
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 302
cache-control: no-store, no-cache, must-revalidate
content-length: 220

GET
H2

200

in
d.adroll.com/cm/r/
Redirect Chain

https://d.adroll.com/cm/r/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishin...
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
https://d.adroll.com/cm/r/in?xid=E0&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

42 B
500 B

45ms
44ms

Image
image/gif

52.215.109.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/r/in?xid=E0&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.109.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-109-198.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:29 GMT
server: nginx/1.16.1
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 200
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 42

Redirect headers

date: Sat, 04 Apr 2020 17:12:29 GMT
referrer-policy: no-referrer-when-downgrade
server: ATS
age: 0
location: https://d.adroll.com/cm/r/in?xid=E0&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
status: 302
x-content-type-options: nosniff
content-length: 0
x-xss-protection: 1; mode=block

GET
H2

204

/
trc.taboola.com/sg/adroll-network/1/rtb-h/
Redirect Chain

https://d.adroll.com/cm/taboola/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-p...
https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ

0
197 B

32ms
32ms

Image
text/plain

151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-vcl-time-ms: 9
date: Sat, 04 Apr 2020 17:12:29 GMT
via: 1.1 varnish
server: nginx
x-timer: S1586020349.180760,VS0,VE9
x-served-by: cache-fra19126-FRA
x-cache: MISS
status: 204
accept-ranges: bytes
x-cache-hits: 0

Redirect headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:29 GMT
server: nginx/1.16.1
location: https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 302
cache-control: no-store, no-cache, must-revalidate
content-length: 111

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://d.adroll.com/cm/triplelift/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-b...
https://eb2.3lift.com/xuid?mid=4714&xuid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&dongle=c85e
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

37 B
352 B

20ms
19ms

Image
image/gif

3.127.164.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.164.217 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-164-217.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Sat, 04 Apr 2020 17:12:29 GMT
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 37
content-type: image/gif

Redirect headers

status: 302
date: Sat, 04 Apr 2020 17:12:29 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: /xuid?ld=1&mid=4714&xuid=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sync
x.bidswitch.net/ul_cb/
Redirect Chain

https://d.adroll.com/cm/b/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishin...
https://x.bidswitch.net/sync?dsp_id=44&user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ

43 B
378 B

22ms
21ms

Image
image/gif

54.93.38.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.38.91 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-38-91.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Sat, 04 Apr 2020 17:12:29 GMT
cache-control: no-cache, no-store, must-revalidate
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 43
content-type: image/gif

Redirect headers

status: 302
date: Sat, 04 Apr 2020 17:12:29 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

https://d.adroll.com/cm/x/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishin...
https://ib.adnxs.com/setuid?entity=172&code=MDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ

43 B
1 KB

40ms
40ms

Image
image/gif

185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.145 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 04 Apr 2020 17:12:31 GMT
AN-X-Request-Uuid: e7ca3ba9-2a25-4cb8-8b18-37177f357627
Content-Type: image/gif
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 91.132.136.84; 91.132.136.84; 623.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.43:80
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 04 Apr 2020 17:12:31 GMT
AN-X-Request-Uuid: b568d309-28e0-4243-8cc1-3382f61f613f
Content-Type: text/html; charset=utf-8
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMDNmMjUwNDNjZGM3M2IyNGU3NDlhODgzMGY1MDlkZDQ
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 91.132.136.84; 91.132.136.84; 623.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.103:80
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

204

377928.gif
idsync.rlcdn.com/
Redirect Chain

https://d.adroll.com/cm/l/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishin...
https://idsync.rlcdn.com/377928.gif?partner_uid=03f25043cdc73b24e749a8830f509dd4

0
40 B

215ms
214ms

Image
text/plain

35.190.72.21
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/377928.gif?partner_uid=03f25043cdc73b24e749a8830f509dd4
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 21.72.190.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Sat, 04 Apr 2020 17:12:29 GMT
via: 1.1 google
alt-svc: clear

Redirect headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:29 GMT
server: nginx/1.16.1
location: https://idsync.rlcdn.com/377928.gif?partner_uid=03f25043cdc73b24e749a8830f509dd4
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 302
cache-control: no-store, no-cache, must-revalidate
content-length: 86

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://d.adroll.com/cm/o/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishin...
https://us-u.openx.net/w/1.0/sd?id=537103138&val=03f25043cdc73b24e749a8830f509dd4
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=03f25043cdc73b24e749a8830f509dd4

43 B
109 B

27ms
27ms

Image
image/gif

34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=03f25043cdc73b24e749a8830f509dd4
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.182.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:29 GMT
via: 1.1 google
server: OXGW/16.182.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
status: 200
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Sat, 04 Apr 2020 17:12:29 GMT
via: 1.1 google
server: OXGW/16.182.1
location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=03f25043cdc73b24e749a8830f509dd4
p3p: CP="CUR ADM OUR NOR STA NID"
status: 302
alt-svc: clear
content-length: 0

GET
H2

200

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?adroll_fpc=aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926&arrfrr=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishin...
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=A_JQQ83HOyTnSaiDD1Cd1A
https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=A_JQQ83HOyTnSaiDD1Cd1A&google_tc=
https://d.adroll.com/cm/g/in

42 B
536 B

43ms
42ms

Image
image/gif

52.215.109.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.109.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-109-198.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:29 GMT
server: nginx/1.16.1
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 200
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 42
x-result: g.-1.-1.-1

Redirect headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:29 GMT
server: HTTP server (unknown)
location: https://d.adroll.com/cm/g/in
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 719861091558308 Show response
connect.facebook.net/signals/config/ 447 KB
112 KB 11ms
10ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/719861091558308?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

73879aec063d455f494286d7f199c5ad8cdb7afe3bdff463976afa2ce6870ff4

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 114918
x-xss-protection: 0
pragma: public
x-fb-debug: Oo8onXSCjS5YT/KYnB8Fc/LoK2lGQv0fryvWmznSpMrCmMDCeI+UFtjzixQ9T1Tji2q/NkijjNAuZHa80toSEA==
x-fb-trip-id: 420120009
date: Sat, 04 Apr 2020 17:12:29 GMT, Sat, 04 Apr 2020 17:12:29 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
247 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=719861091558308&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758&rl=&if=false&ts=1586020349097&cd[segment_eid]=RBXJKDWUZRBXZHBJURU5IH&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=29&fbp=fb.1.1586020349097.2039144316&it=1586020349049&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 17:12:29 GMT, Sat, 04 Apr 2020 17:12:29 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 04 Apr 2020 17:12:29 GMT

GET
H2 200 / Show response
api.omappapi.com/v2/geolocate/json/ 229 B
542 B 117ms
116ms XHR
application/json 50.17.52.222
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/geolocate/json/
Requested by: Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.17.52.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-52-222.compute-1.amazonaws.com
Software: Pagely Gateway/1.5.1 /
Resource Hash: e41220c2128175e68ab850e237df17c733d845bbf1e2e854c2261bdbf8cd83e8

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Origin: https://www.fortinet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-user-agent: standard
x-cache-config: 0 0
server: Pagely Gateway/1.5.1
status: 200
date: Sat, 04 Apr 2020 17:12:29 GMT
x-cache-status: BYPASS
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.fortinet.com
x-ratelimit-remaining: 998
access-control-allow-credentials: true
x-ratelimit-reset: 1586020376
x-ratelimit-limit: 1000
x-database-date: Fri, 21 Feb 2020 21:31:44 GMT
content-length: 229

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.5.18/ 16 KB
6 KB 5ms
5ms Script
text/javascript 2a00:1450:4001:818::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Requested by

Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 11:59:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18766
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 6490
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Apr 2021 11:59:43 GMT

GET
H2 200 mobile-detect.min.js Show response
cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.4.3/ 38 KB
15 KB 32ms
32ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.4.3/mobile-detect.min.js

Requested by

Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

363a80d367e6658e72d918cd33f9481ce7929199a9858122b0dcc61dffa62fde

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:29 GMT
content-encoding: br
cf-cache-status: HIT
age: 4956873
cf-ray: 57eca78fc93ec2f4-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Sat, 08 Sep 2018 10:00:50 GMT
server: cloudflare
etag: W/"5b939dd2-9624"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Thu, 25 Mar 2021 17:12:29 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.002

GET
H/1.1 200
OK bf9b60c3e96b1585247218-threat-report-banner.jpg
optin-monster.s3.amazonaws.com/users/df0603609574/images/ 35 KB
36 KB 479ms
133ms Image
image/jpeg 52.216.76.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optin-monster.s3.amazonaws.com/users/df0603609574/images/bf9b60c3e96b1585247218-threat-report-banner.jpg
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.76.92 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: d96d8bb5de5c3c7d077b9a04db8edc60331510291bc09c684324b184423d4581

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sat, 04 Apr 2020 17:12:30 GMT
x-amz-request-id: 9A0CEFE58CD0E297
x-amz-meta-date: 1585247218
Content-Length: 35900
x-amz-id-2: th75H8jf0pHRKKcAGdWoWTwl2PjP2vZ+GfuxvgbZj8Lu4VIyX5E9qcwkCPgKJZX43vqCz9WWdDc=
x-amz-meta-level: pro
x-amz-meta-dimensions: 1024 x 160
Last-Modified: Thu, 26 Mar 2020 18:26:59 GMT
Server: AmazonS3
x-amz-meta-accountid: 45602
ETag: "82bb8793b2035d46f8a850a8bceb53d8"
Content-Type: image/jpeg
x-amz-meta-userid: 39852
x-amz-meta-title: bf9b60c3e96b1585247218-threat-report-banner.jpg
Cache-Control: 31104000
Accept-Ranges: bytes
Expires: Fri, 26 Mar 2021 18:26:58 GMT

GET
DATA 200
OK truncated
/ 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2b441d8e9bf/ 819 B
744 B 26ms
26ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2b441d8e9bf/RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9c8f8b4d88e8951623a9c46a03e636955aac122d934546c52cdd42b4fa8879e5

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:30 GMT
content-encoding: gzip
last-modified: Fri, 03 Apr 2020 17:50:55 GMT
server: AkamaiNetStorage
etag: "ac46e4cbc68ef5eae60bb02f25b8d192:1585936255.360317"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 500
expires: Sat, 04 Apr 2020 18:12:30 GMT

GET
H2 200 RC0b6c219cefad47a7856f990eee551ad6-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2b441d8e9bf/ 847 B
722 B 27ms
26ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2b441d8e9bf/RC0b6c219cefad47a7856f990eee551ad6-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: fc7601c09b88672a497c2399368c247466983dd0e6d7ddf602c73aa49a801919

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:30 GMT
content-encoding: gzip
last-modified: Fri, 03 Apr 2020 17:50:55 GMT
server: AkamaiNetStorage
etag: "ac46e4cbc68ef5eae60bb02f25b8d192:1585936255.360317"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 477
expires: Sat, 04 Apr 2020 18:12:30 GMT

GET
H2 200 RC4da2046cb6a74ff89eee84fdeadc51af-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2b441d8e9bf/ 1005 B
833 B 27ms
27ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/b2b441d8e9bf/RC4da2046cb6a74ff89eee84fdeadc51af-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f8061b10721836e53b4a7c853a32b008cb9f64c768815b0dce12609a4a0b7de1

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:30 GMT
content-encoding: gzip
last-modified: Fri, 03 Apr 2020 17:50:55 GMT
server: AkamaiNetStorage
etag: "ac46e4cbc68ef5eae60bb02f25b8d192:1585936255.360317"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 588
expires: Sat, 04 Apr 2020 18:12:30 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 20ms
19ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:30 GMT
content-encoding: gzip
age: 32308
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1586020350.058853,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 8ms
7ms Script
application/x-javascript 2a02:26f0:f1:29d::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f1:29d::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sat, 04 Apr 2020 17:12:30 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=32488
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 559328277756725 Show response
connect.facebook.net/signals/config/ 447 KB
112 KB 11ms
10ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/559328277756725?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

42fbdf2993092cb323cbad85cdb15192ce4e7f5f9c8c776ffadf7e4e48c14fd2

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 114918
x-xss-protection: 0
pragma: public
x-fb-debug: QD1Gef2hfzzIZ/lb1ZqwTvGjGFIuZhPaM4HKbE5XFhvqGr4MehGy2eHtE38eRrbkBOU6CsKzd6Ipd6dfaMgtqw==
x-fb-trip-id: 420120009
date: Sat, 04 Apr 2020 17:12:30 GMT, Sat, 04 Apr 2020 17:12:30 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
283 B 148ms
148ms Script
application/javascript 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqCampaignId%3D14758

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 17:12:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 122
pragma: no-cache
last-modified: Sat, 04 Apr 2020 17:12:30 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 867b28e34de1f19f8fab900ae50a94f8
x-transaction: 009e689d00d58f3c
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
171 B 147ms
147ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 17:12:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 117
pragma: no-cache
last-modified: Sat, 04 Apr 2020 17:12:30 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 29101d0f0b7b692d14235fe9a3048503
x-transaction: 008c8df1009f6503
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2

200

/
cx.atdmt.com/
Redirect Chain

https://www.facebook.com/tr/?id=559328277756725&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3FelqTrackId%3Da835c17275...
https://cx.atdmt.com/?c=6636927192357580200&f=AYwoDkHeWDF7PjUNvh-ZmQrail2xoGFpMxZidAlDDsWEAb96sv7q6mLlNIvZIqWNWdfDEZ74UJL-MtR43zSNPaS1&id=559328277756725&l=3&v=0

42 B
316 B

39ms
39ms

Image
image/gif

2a03:2880:f01c:8004:face:b00c:0:8c
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cx.atdmt.com/?c=6636927192357580200&f=AYwoDkHeWDF7PjUNvh-ZmQrail2xoGFpMxZidAlDDsWEAb96sv7q6mLlNIvZIqWNWdfDEZ74UJL-MtR43zSNPaS1&id=559328277756725&l=3&v=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8004:face:b00c:0:8c , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Sat, 04 Apr 2020 17:12:30 GMT, Sat, 04 Apr 2020 17:12:30 GMT, Sat, 04 Apr 2020 17:12:30 GMT
p3p: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
alt-svc: h3-27=":443"; ma=3600
content-length: 42
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 04 Apr 2020 17:12:30 GMT, Sat, 04 Apr 2020 17:12:30 GMT
server: proxygen-bolt
location: https://cx.atdmt.com/?c=6636927192357580200&f=AYwoDkHeWDF7PjUNvh-ZmQrail2xoGFpMxZidAlDDsWEAb96sv7q6mLlNIvZIqWNWdfDEZ74UJL-MtR43zSNPaS1&id=559328277756725&l=3&v=0
content-type: text/plain
status: 302
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=3600
content-length: 0
expires: 0

POST
H2 200 /
www.facebook.com/tr/ 0
49 B 8ms
7ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html?elqTrackId=a835c172758745c8ad75bc94290a7a06&elq=e318f22a1fad489b9ecc8cfb005633da&elqaid=19731&elqat=1&elqCampaignId=14758
Origin: https://www.fortinet.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUoTn3PstAYj0fdBO

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
access-control-allow-origin: https://www.fortinet.com
date: Sat, 04 Apr 2020 17:12:30 GMT
content-type: text/plain
status: 200
access-control-allow-credentials: true
alt-svc: h3-27=":443"; ma=3600
content-length: 0

Verdicts & Comments Add Verdict or Comment

169 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.fortinet.com/	1970-01-19 10:43:16	Name: _fbp Value: fb.1.1586020349097.2039144316
.www.fortinet.com/	1970-01-19 17:19:37	Name: __adroll_fpc Value: aa45bd5b174288f7ff4ffa7626a4d31a-1586020348926
.fortinet.com/	1970-01-20 02:04:52	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: -432600572%7CMCIDTS%7C18357%7CMCMID%7C25621210838653587073874468468281887694%7CMCAAMLH-1586625148%7C6%7CMCAAMB-1586625148%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1586027548s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18364%7CvVersion%7C4.5.2
www.fortinet.com/	1970-01-23 08:32:13	Name: _omappvp Value: 8VZVD3CIYIuzid0V9EqUeRUlijn4c9Kp06hDihMy7gqt0GAf4jVcmJihJ3VQo8DfuTkIbnAC4hfRVHMBUehS6c7btEoFXp8s
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.fortinet.com/	1970-01-20 02:04:52	Name: s_ecid Value: MCMID%7C25621210838653587073874468468281887694
.fortinet.com/	1970-01-19 08:33:42	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fnew-agent-tesla-variant-spreading-by-phishing.html%3Felqtrackid%3Da835c172758745c8ad75bc94290a7a06%26elq%3De318f22a1fad489b9ecc8cfb005633da%26elqaid%3D19731%26elqat%3D1%26elqcampaignid%3D14758
.fortinet.com/	1970-01-19 10:43:16	Name: s_getNewRepeat Value: 1586020348824-New
www.fortinet.com/	1970-01-19 08:33:40	Name: _omappvs Value: 1586020348843
.fortinet.com/	1970-01-19 08:35:06	Name: _gid Value: GA1.2.1752106668.1586020349
www.fortinet.com/	1970-01-19 18:02:28	Name: __atuvc Value: 1%7C14
.fortinet.com/	1970-01-19 08:33:40	Name: _gat_UA-767980-6 Value: 1
.demdex.net/	1970-01-19 12:52:52	Name: demdex Value: 25243660902302517713837843772327520838
www.fortinet.com/	1970-01-19 09:16:52	Name: omSeen-qbkzwxxbiv83f0ol5a2d Value: 1586020350018
.fortinet.com/	1970-01-20 02:04:52	Name: _ga Value: GA1.2.776377828.1586020349
www.fortinet.com/	1970-01-19 08:33:42	Name: __atuvs Value: 5e88bffc5125c589000
.www.fortinet.com/	1970-01-19 17:19:16	Name: __ar_v4 Value: %7C7OBVBCAQE5FHDPFEAD5T4D%3A20200404%3A1%7CGIVUJ77KRNF4LOPGYJ6RS5%3A20200404%3A1%7CRBXJKDWUZRBXZHBJURU5IH%3A20200404%3A1
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.optmnstr.com
ads.yahoo.com
ajax.googleapis.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
cdnjs.cloudflare.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
cx.atdmt.com
d.adroll.com
d.adroll.mgr.consensu.org
dpm.demdex.net
dsum-sec.casalemedia.com
eb2.3lift.com
fortinet.demdex.net
ib.adnxs.com
idsync.rlcdn.com
metrics.fortinet.com
optin-monster.s3.amazonaws.com
pixel.advertising.com
pixel.rubiconproject.com
px.ads.linkedin.com
s.adroll.com
s7.addthis.com
simage2.pubmatic.com
snap.licdn.com
static.ads-twitter.com
sync.outbrain.com
t.co
trc.taboola.com
ups.analytics.yahoo.com
us-u.openx.net
v1.addthisedge.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.googletagmanager.com
www.linkedin.com
x.bidswitch.net
z.moatads.com
104.244.42.131
104.244.42.69
151.101.112.157
151.101.13.44
172.217.22.98
185.33.220.145
185.64.189.110
23.111.9.217
23.210.248.216
23.210.248.44
23.210.248.45
23.210.249.164
23.210.250.213
2606:4700::6811:4104
2a00:1288:f03d:1fa::2000
2a00:1450:4001:800::2008
2a00:1450:4001:817::200e
2a00:1450:4001:818::200a
2a02:26f0:f1:29d::25ea
2a03:2880:f01c:8004:face:b00c:0:8c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
2a05:f500:11:101::b93f:9001
3.126.56.137
3.127.164.217
34.249.189.231
34.95.120.147
35.181.91.36
35.190.72.21
50.17.52.222
52.215.109.198
52.216.76.92
52.50.37.223
52.52.208.2
54.93.143.252
54.93.38.91
66.117.28.86
69.173.144.138
70.42.32.63
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11b05d9614b7dd97a53463d7d9a275c325431bf0d01af420f8a4d43e7174dde8
133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb
19c904aaa555d91d75c5b3682e3f358ba5af4c302339d63c9e464f53d8708ff8
1bdbcee5cd776cb671f72362db4be8dde833057b8e8f816c86fd301896652c8d
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
363a80d367e6658e72d918cd33f9481ce7929199a9858122b0dcc61dffa62fde
3fcd447726350779a15c76241650b91e4932c1a064a7ddd508cdcaf40d2b7db5
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
42fbdf2993092cb323cbad85cdb15192ce4e7f5f9c8c776ffadf7e4e48c14fd2
4687e8b612d5c3d2474cfbd116a3897f3c7355c62e48614a78acbbf269938d09
4a1bd50c41da75d6e444c7da9812ad6d9f5f41e00b27a5bc570d5c6840f97cc8
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
533f36b8be9917035e75d975c0f6962ccb33808f1f4cd04cfddd181e28b4edd3
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55b80a833d7a1674b2cf54418d98b05801670607c99eacc333d79ed4c969a7cb
5723c9474d9e82996e314a3f818c958e3e86c9ce4656d8cdfed490f4a5df89f1
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
73879aec063d455f494286d7f199c5ad8cdb7afe3bdff463976afa2ce6870ff4
7934063bb44880cb75fee170a559b2350ff23454f8ec01dec4b8e75f667a174c
7a19ff8cb29bb3eb64c4629650f09dd2f2fa5a96983bc14b2e099ec7223c26ca
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9c8f8b4d88e8951623a9c46a03e636955aac122d934546c52cdd42b4fa8879e5
a0cda6180b83b4f2c51e115d8edfaf4eb0fe16ab2514e8bf6f718ed3f1cff758
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a55db6ce7f6660f8bd63293e801bf3ae471ca4335e5b465ec8c4b3116e3aa19d
aa50be672f4a9019b33642489eed7731ad0cb5a7a68269ecb8c076b2fa213f4a
ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad979cd8209daf4934baefa31ec4dede21ae9cc233cf809da2ed5ed839f03a68
adfcb165c69213b0aba3c64bc549f7ff156ec82110fb8ef144b1d16ebc13b04a
af3459ac72572ffd822a1ebc21101b8749a111cf0e1948f419caed74286557dd
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
baad6870255b11b5a30e851c6e4e2d16a50201c8dd3589157cb1b4e96557e52d
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
d0e9155073e7ffd98c57ebe40523d6f99edb803473c42477c2ef54dbbd0218d4
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d96d8bb5de5c3c7d077b9a04db8edc60331510291bc09c684324b184423d4581
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df6309120d0e89c7ab6ca5f5e0f300db33d8a930381a88ac54bb47cf603873c5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41220c2128175e68ab850e237df17c733d845bbf1e2e854c2261bdbf8cd83e8
e717cb376f9160bc32d1cff24effc117c256426184e0d55727ed04fd86f779d7
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f8061b10721836e53b4a7c853a32b008cb9f64c768815b0dce12609a4a0b7de1
fc7601c09b88672a497c2399368c247466983dd0e6d7ddf602c73aa49a801919

www.fortinet.com Open in urlscan Pro 52.52.208.2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

66 Requests

100 %HTTPS

28 %IPv6

37 Domains

42 Subdomains

36 IPs

7 Countries

1426 kBTransfer

4001 kBSize

18 Cookies

11 Outgoing links

Redirected requests

66 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.fortinet.com Open in urlscan Pro
52.52.208.2 Public Scan

Screenshot
Live screenshot

Full Image

66
Requests

100 %
HTTPS

28 %
IPv6

37
Domains

42
Subdomains

36
IPs

7
Countries

1426 kB
Transfer

4001 kB
Size

18
Cookies

66 HTTP transactions
3 data transactions