www.horizon3.ai Open in urlscan Pro
104.197.16.226 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
Effective URL:
https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
Submission: On March 13 via api (March 13th 2024, 10:13:33 am UTC) from IN — Scanned from DE

Summary HTTP 113 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 23 IPs in 3 countries across 20 domains to perform 113 HTTP transactions. The main IP is 104.197.16.226, located in Council Bluffs, United States and belongs to GOOGLE, US. The main domain is www.horizon3.ai.
TLS certificate: Issued by R3 on February 27th 2024. Valid for: 3 months.

This is the only time www.horizon3.ai was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 10	104.197.16.226 104.197.16.226	15169 (GOOGLE) (GOOGLE)
64	2400:52e0:1e0... 2400:52e0:1e00::1082:1	200325 (BUNNYCDN) (BUNNYCDN)
1	52.4.219.252 52.4.219.252	14618 (AMAZON-AES) (AMAZON-AES)
4	2606:4700::68... 2606:4700::6810:5814	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:600... 2a04:4e42:600::649	54113 (FASTLY) (FASTLY)
3	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
2	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2606:4700::68... 2606:4700::6810:880f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a04:4e42:200... 2a04:4e42:200::396	54113 (FASTLY) (FASTLY)
3	3.92.120.28 3.92.120.28	14618 (AMAZON-AES) (AMAZON-AES)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:148d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:20:... 2606:4700:20::681a:c98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	34.120.220.80 34.120.220.80	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	151.101.65.140 151.101.65.140	54113 (FASTLY) (FASTLY)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c06::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
8	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
2	2606:4700:20:... 2606:4700:20::ac43:44c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
113	23

10 104.197.16.226 (Council Bluffs, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 226.16.197.104.bc.googleusercontent.com

www.horizon3.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

64 2400:52e0:1e00::1082:1 (Germany)

ASN200325 (BUNNYCDN, SI)

p7i3u3x3.rocketcdn.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.4.219.252 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-219-252.compute-1.amazonaws.com

boards.greenhouse.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:5814 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.117.77.79 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:880f (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:200::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.92.120.28 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-92-120-28.compute-1.amazonaws.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
go.horizon3.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:148d (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:c98 (United States)

ASN13335 (CLOUDFLARENET, US)

io.clickguard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.120.220.80 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 80.220.120.34.bc.googleusercontent.com

cdn.dreamdata.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:44c4 (United States)

ASN13335 (CLOUDFLARENET, US)

pulse.clickguard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
64	rocketcdn.me p7i3u3x3.rocketcdn.me	2 MB
11	horizon3.ai 1 redirects www.horizon3.ai go.horizon3.ai	356 KB
8	gstatic.com fonts.gstatic.com	218 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 353 www.linkedin.com — Cisco Umbrella Rank: 629 px4.ads.linkedin.com — Cisco Umbrella Rank: 6596	3 KB
4	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 310	21 KB
3	dreamdata.cloud cdn.dreamdata.cloud — Cisco Umbrella Rank: 48937	43 KB
3	clickguard.com io.clickguard.com — Cisco Umbrella Rank: 60126 pulse.clickguard.com — Cisco Umbrella Rank: 48778	4 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	268 KB
2	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2656	308 B
2	pardot.com pi.pardot.com — Cisco Umbrella Rank: 5113	4 KB
2	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1245	10 KB
2	ml314.com ml314.com — Cisco Umbrella Rank: 1968	11 KB
1	google.de www.google.de — Cisco Umbrella Rank: 6744	408 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 84	254 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1415	637 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 781	17 KB
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4571	2 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 760	124 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 228	17 KB
1	greenhouse.io boards.greenhouse.io — Cisco Umbrella Rank: 46116	2 KB
113	20

	Domain	Requested by
64	p7i3u3x3.rocketcdn.me	www.horizon3.ai p7i3u3x3.rocketcdn.me
10	www.horizon3.ai	1 redirects www.horizon3.ai p7i3u3x3.rocketcdn.me
8	fonts.gstatic.com	www.horizon3.ai
4	px.ads.linkedin.com	3 redirects snap.licdn.com
4	cdn.jsdelivr.net	www.horizon3.ai
3	cdn.dreamdata.cloud	www.horizon3.ai cdn.dreamdata.cloud
3	www.googletagmanager.com	www.horizon3.ai www.googletagmanager.com
2	pulse.clickguard.com	io.clickguard.com
2	region1.analytics.google.com	www.googletagmanager.com
2	pi.pardot.com	www.horizon3.ai pi.pardot.com
2	www.redditstatic.com	www.googletagmanager.com www.redditstatic.com
2	ml314.com	www.horizon3.ai ml314.com
1	go.horizon3.ai	pi.pardot.com
1	px4.ads.linkedin.com	www.horizon3.ai
1	www.linkedin.com	1 redirects
1	www.google.de	www.horizon3.ai
1	stats.g.doubleclick.net	www.googletagmanager.com
1	alb.reddit.com	www.horizon3.ai
1	io.clickguard.com	www.googletagmanager.com
1	snap.licdn.com	www.horizon3.ai
1	ws.zoominfo.com	www.horizon3.ai
1	code.jquery.com	www.horizon3.ai
1	cdnjs.cloudflare.com	www.horizon3.ai
1	boards.greenhouse.io	www.horizon3.ai
113	24

This site contains links to these domains. Also see Links.

Domain
portal.horizon3ai.com
docs.horizon3.ai
partners.horizon3.ai
go.horizon3.ai
www.businesswire.com
www.globenewswire.com
www.crn.com
twitter.com
www.linkedin.com
www.youtube.com
github.com
www.fortra.com
p7i3u3x3.rocketcdn.me
trust.horizon3.ai
www.cookieyes.com

Subject Issuer	Validity	Valid
www.horizon3.ai R3	`2024-02-27` - `2024-05-27`	3 months	crt.sh
*.rocketcdn.me R3	`2024-02-26` - `2024-05-26`	3 months	crt.sh
*.greenhouse.io R3	`2024-01-26` - `2024-04-25`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
event-horizon.gcp.bomm.in GTS CA 1D4	`2024-02-28` - `2024-05-28`	3 months	crt.sh
zoominfo.com E1	`2024-02-20` - `2024-05-20`	3 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-08` - `2024-07-06`	6 months	crt.sh
pi.pardot.com DigiCert TLS RSA SHA256 2020 CA1	`2023-07-25` - `2024-07-23`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
cdn.dreamdata.cloud GTS CA 1D4	`2024-03-05` - `2024-06-03`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-01-15` - `2024-07-13`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
www.google.de GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
go.horizon3.ai R3	`2024-03-05` - `2024-06-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
Frame ID: 18E06B1BDB89A63EADE4C3A06EA7424B
Requests: 129 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive – Horizon3.ai

Page URL History Show full URLs

https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ HTTP 301
https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authenticat... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

jQuery Mobile (Mobile Frameworks) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]mobile(?:-([\d.]))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Moment.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

moment(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

113
Requests

99 %
HTTPS

68 %
IPv6

20
Domains

24
Subdomains

23
IPs

3
Countries

2762 kB
Transfer

6538 kB
Size

30
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://portal.horizon3ai.com/
Title: Start a Free Trial

Search URL Search Domain Scan URL

URL: https://docs.horizon3.ai/getting_started/
Title: Documentation

Search URL Search Domain Scan URL

URL: https://partners.horizon3.ai/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://go.horizon3.ai/l/971073/2024-02-27/31k84
Title: What’s the true impact on your organization when an employee is phished?

Search URL Search Domain Scan URL

URL: https://www.businesswire.com/news/home/20240305970285/en/Horizon3.ai-Unveils-Pentesting-Services-for-Compliance-Ahead-of-PCI-DSS-v4.0-Rollout
Title: Horizon3.ai Unveils Pentesting Services for Compliance Ahead of PCI DSS v4.0 Rollout

Search URL Search Domain Scan URL

URL: https://www.globenewswire.com/news-release/2023/12/14/2796472/0/en/Security-Today-Announces-Winners-of-the-2023-CyberSecured-Awards.html
Title: <picture decoding="async" class=""> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-CyberSecured.png.webp 479w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-CyberSecured.png.webp 480w" sizes="(max-width:479px) 479px, 100vw"/> <img decoding="async" src="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-CyberSecured.png" alt="2023 Security Today CyberSecured Awards" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-CyberSecured.png 479w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-CyberSecured.png 480w" sizes="(max-width:479px) 479px, 100vw" width="400" height="250"/> </picture>

Search URL Search Domain Scan URL

URL: https://www.crn.com/rankings-and-lists/stellar-startups-2023.htm
Title: <picture decoding="async" class=""> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-23-stellar-CRN.png.webp 479w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-23-stellar-CRN.png.webp 480w" sizes="(max-width:479px) 479px, 100vw"/> <img decoding="async" src="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-23-stellar-CRN.png" alt="2023 CRN Stellar-Startup" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-23-stellar-CRN.png 479w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-23-stellar-CRN.png 480w" sizes="(max-width:479px) 479px, 100vw" width="400" height="250"/> </picture>

Search URL Search Domain Scan URL

URL: https://twitter.com/Horizon3ai
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/horizon3ai/
Title: 

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCruHUp4feksCLYU6CbNvdlw
Title: 

Search URL Search Domain Scan URL

URL: https://github.com/horizon3ai
Title: 

Search URL Search Domain Scan URL

URL: https://www.fortra.com/security/advisory/fi-2024-001
Title: security advisory

Search URL Search Domain Scan URL

URL: https://twitter.com/malcolmx0x
Title: malcolm0x

Search URL Search Domain Scan URL

URL: https://twitter.com/IslamRalsaid1
Title: Islam Elrfai

Search URL Search Domain Scan URL

URL: https://github.com/horizon3ai/CVE-2024-0204
Title: here

Search URL Search Domain Scan URL

URL: https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.03.34%E2%80%AFPM.png
Title: <picture decoding="async" class="aligncenter size-full wp-image-242852"> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.03.34 PM.png.webp 842w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.03.34 PM-300x35.png.webp 300w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.03.34 PM-768x89.png.webp 768w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.03.34 PM-480x56.png.webp 480w" sizes="(max-width: 842px) 100vw, 842px"/> <img decoding="async" src="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.03.34 PM.png" alt="" width="842" height="98" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.03.34 PM.png 842w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.03.34 PM-300x35.png 300w, https://p7i3u3x3.

Search URL Search Domain Scan URL

URL: https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.11.13%E2%80%AFPM.png
Title: <picture decoding="async" class="aligncenter wp-image-242853"> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.11.13 PM.png.webp 853w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.11.13 PM-300x91.png.webp 300w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.11.13 PM-768x233.png.webp 768w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.11.13 PM-480x146.png.webp 480w" sizes="(max-width: 600px) 100vw, 600px"/> <img decoding="async" src="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.11.13 PM.png" alt="" width="600" height="182" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.11.13 PM.png 853w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.11.13 PM-300x91.png 300w, https://p7i3u3x3.rocketc

Search URL Search Domain Scan URL

URL: https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.26.37%E2%80%AFPM.png
Title: <picture decoding="async" aria-describedby="caption-attachment-242863" class="wp-image-242863 size-full"> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.26.37 PM.png.webp 2880w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.26.37 PM-300x165.png.webp 300w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.26.37 PM-1024x565.png.webp 1024w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.26.37 PM-768x424.png.webp 768w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.26.37 PM-1536x847.png.webp 1536w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.26.37 PM-2048x1130.png.webp 2048w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.26.37 PM-1080x596.png.webp 1080w, https://p7i3u3x3.rocketcdn.me/wp-content/u

Search URL Search Domain Scan URL

URL: https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.23.11%E2%80%AFPM.png
Title: <picture decoding="async" class="aligncenter wp-image-242854"> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.23.11 PM.png.webp 522w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.23.11 PM-300x297.png.webp 300w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.23.11 PM-150x150.png.webp 150w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.23.11 PM-480x475.png.webp 480w" sizes="(max-width: 341px) 100vw, 341px"/> <img decoding="async" src="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.23.11 PM.png" alt="" width="341" height="338" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.23.11 PM.png 522w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.23.11 PM-300x297.png 300w, https://p7i3u3x3.rocke

Search URL Search Domain Scan URL

URL: https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-11.52.58%E2%80%AFAM.png
Title: <picture decoding="async" class="aligncenter size-full wp-image-242855"> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-11.52.58 AM.png.webp 1087w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-11.52.58 AM-300x76.png.webp 300w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-11.52.58 AM-1024x260.png.webp 1024w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-11.52.58 AM-768x195.png.webp 768w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-11.52.58 AM-1080x274.png.webp 1080w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-11.52.58 AM-980x249.png.webp 980w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-11.52.58 AM-480x122.png.webp 480w" sizes="(max-width: 1087px) 100vw, 1087px"/> <img decoding="async" src="htt

Search URL Search Domain Scan URL

URL: https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.29.52%E2%80%AFPM-1.png
Title: <picture decoding="async" class="aligncenter wp-image-242857"> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.29.52 PM-1.png.webp 975w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.29.52 PM-1-300x205.png.webp 300w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.29.52 PM-1-768x525.png.webp 768w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.29.52 PM-1-480x328.png.webp 480w" sizes="(max-width: 571px) 100vw, 571px"/> <img decoding="async" src="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.29.52 PM-1.png" alt="" width="571" height="391" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.29.52 PM-1.png 975w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.29.52 PM-1-300x205.png 300w, https://

Search URL Search Domain Scan URL

URL: https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.43.38%E2%80%AFPM.png
Title: <picture decoding="async" class="aligncenter wp-image-242858"> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.43.38 PM.png.webp 770w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.43.38 PM-300x252.png.webp 300w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.43.38 PM-768x645.png.webp 768w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.43.38 PM-480x403.png.webp 480w" sizes="(max-width: 456px) 100vw, 456px"/> <img decoding="async" src="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.43.38 PM.png" alt="" width="456" height="383" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.43.38 PM.png 770w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.43.38 PM-300x252.png 300w, https://p7i3u3x3.rocke

Search URL Search Domain Scan URL

URL: https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-1.39.09%E2%80%AFPM.png
Title: <picture decoding="async" class="aligncenter wp-image-242859"> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-1.39.09 PM.png.webp 621w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-1.39.09 PM-300x215.png.webp 300w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-1.39.09 PM-480x344.png.webp 480w" sizes="(max-width: 370px) 100vw, 370px"/> <img decoding="async" src="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-1.39.09 PM.png" alt="" width="370" height="265" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-1.39.09 PM.png 621w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-1.39.09 PM-300x215.png 300w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-1.39.09 PM-480x344.png 480w" sizes="(max-width: 370px) 1

Search URL Search Domain Scan URL

URL: https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.08.21%E2%80%AFPM.png
Title: <picture decoding="async" class="aligncenter wp-image-242860"> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.08.21 PM.png.webp 1150w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.08.21 PM-300x18.png.webp 300w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.08.21 PM-1024x61.png.webp 1024w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.08.21 PM-768x46.png.webp 768w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.08.21 PM-1080x65.png.webp 1080w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.08.21 PM-980x59.png.webp 980w, https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.08.21 PM-480x29.png.webp 480w" sizes="(max-width: 643px) 100vw, 643px"/> <img decoding="async" src="https://p7i3u3x3.rocketcdn.

Search URL Search Domain Scan URL

URL: https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/streamlinehq-cog-approved-interface-essential-100.png
Title: <picture decoding="async" title="streamlinehq-cog-approved-interface-essential-100" class="wp-image-4330"> <source type="image/webp" srcset="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/streamlinehq-cog-approved-interface-essential-100.png.webp"/> <img decoding="async" width="100" height="100" src="https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/streamlinehq-cog-approved-interface-essential-100.png" alt=""/> </picture>

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/horizon3ai
Title: Follow

Search URL Search Domain Scan URL

URL: https://trust.horizon3.ai/
Title: Trust Center

Search URL Search Domain Scan URL

URL: https://www.cookieyes.com/
Title: <img width="300" height="60" src="https://p7i3u3x3.rocketcdn.me/wp-content/plugins/cookie-law-info/legacy/public/images/logo-cookieyes.svg" alt="CookieYes Logo">

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ HTTP 301
https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 92

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1710324808186&li_adsId=8e61cddc-2954-461c-aabc-816dd7abfe52&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1710324808186&li_adsId=8e61cddc-2954-461c-aabc-816dd7abfe52&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3527860%26time%3D1710324808186%26li_adsId%3D8e61cddc-2954-461c-aabc-816dd7abfe52%26url%3Dhttps%253A%252F%252Fwww.horizon3.ai%252Fattack-research%252Fattack-blogs%252Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1710324808186&li_adsId=8e61cddc-2954-461c-aabc-816dd7abfe52&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1710324808186&li_adsId=8e61cddc-2954-461c-aabc-816dd7abfe52&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F&cookiesTest=true&liSync=true&e_ipv6=AQLiJagLJWK7wQAAAY43TXv_9cOW8WWCh_DPzcB7QSXmoeuVKOdKzPF4TgCxEptJ7aJTgt8s5ORJ

113 HTTP transactions
17 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
Redirect Chain

https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

461 KB
60 KB

190ms
190ms

Document
text/html

104.197.16.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.197.16.226 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

226.16.197.104.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

3d9f625292ecba053f6254edbfef51e940c198ab41e23ff4382b340df3d605bd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=600, must-revalidate
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Wed, 13 Mar 2024 10:13:27 GMT
last-modified: Tue, 23 Jan 2024 17:48:33 GMT
link: <https://www.horizon3.ai/wp-json/>; rel="https://api.w.org/" <https://www.horizon3.ai/wp-json/wp/v2/posts/242851>; rel="alternate"; type="application/json" <https://www.horizon3.ai/?p=242851>; rel=shortlink
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
referrer-policy: no-referrer-when-downgrade
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: HIT: 2
x-cache-group: normal
x-cacheable: SHORT
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: WP Engine
x-tec-api-origin: https://www.horizon3.ai
x-tec-api-root: https://www.horizon3.ai/wp-json/tribe/events/v1/
x-tec-api-version: v1
x-xss-protection: "1; mode=block"

Redirect headers

cache-control: max-age=600, must-revalidate
content-length: 0
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Wed, 13 Mar 2024 10:13:27 GMT
expires: Wed, 13 Mar 2024 11:13:25 GMT
location: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
referrer-policy: no-referrer-when-downgrade
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache: HIT: 1
x-cache-group: normal
x-cacheable: non200
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: WP Engine
x-redirect-by: redirection
x-xss-protection: "1; mode=block"

GET
H2 200 style.min.css
p7i3u3x3.rocketcdn.me/wp-includes/css/dist/block-library/ 108 KB
16 KB 179ms
49ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-includes/css/dist/block-library/style.min.css?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

0085adfd2d08a45f62a06d8f3f969ddc4a94ebe8d226511db90aa038f11ed180

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:14
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 12 Feb 2024 01:54:50 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65c97a6a-1ae43"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 5328fe00f5291285857c55807fc184c5
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-includes/css/dist/block-library/style.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 aiwp-public.css
p7i3u3x3.rocketcdn.me/wp-content/plugins/aiwp/public/css/ 98 B
2 KB 179ms
50ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/aiwp/public/css/aiwp-public.css?ver=2.0.0

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1081
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:48 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"651e190c-62"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 64ffc55a87c6483bdb7bdce8b4683aaf
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/plugins/aiwp/public/css/aiwp-public.css?ver=2.0.0>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 cookie-law-info-public.css
p7i3u3x3.rocketcdn.me/wp-content/plugins/cookie-law-info/legacy/public/css/ 3 KB
2 KB 238ms
108ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-public.css?ver=3.2.0

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:58:24 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed13c0-c22"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 187dc011fd5fbacfa4a3a3af2ca5ef52
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-public.css?ver=3.2.0>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 cookie-law-info-gdpr.css
p7i3u3x3.rocketcdn.me/wp-content/plugins/cookie-law-info/legacy/public/css/ 27 KB
6 KB 195ms
65ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-gdpr.css?ver=3.2.0

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:58:24 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed13c0-6a71"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 574444927e11c3c5b96a00b0a618c9b6
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-gdpr.css?ver=3.2.0>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css
p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/ 170 KB
18 KB 129ms
59ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css?ver=1710256053

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

4dea74288ba43d5f6c5de24977925baab55feac9a0c7861b86ecee6cb3001f3a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/13/2024 10:13:26
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Mar 2024 15:25:04 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65f073d0-2a9e0"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 2df2570b436e6afbcbf86cefba316940
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css?ver=1710256053>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851.css
p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/ 13 KB
4 KB 134ms
65ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851.css?ver=1710256053

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

a73567cca36667ab843bd6a8ac3edd2078106a81dc96cb783b3e028f9d2ad0c5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1081
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/13/2024 10:13:26
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Mar 2024 15:07:33 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65f06fb5-33bb"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 7a8470c966c50160b60a59cdb31f77dc
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851.css?ver=1710256053>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 style.min.css
p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-ajax-filter/styles/ 77 KB
13 KB 149ms
80ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-ajax-filter/styles/style.min.css?ver=3.1.6.1&wpr_t=1710308784

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

1dbc030edb44538250da49a7541e946f8434cbe20598e5e85d384471428f1862

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1081
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:51:29
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Mar 2024 19:38:22 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65f0af2e-13588"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: aa6f4b9d362bf185d49802acd54f4a86
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-ajax-filter/styles/style.min.css?ver=3.1.6.1&wpr_t=1710258686>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 style.min.css
p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-blog-extras/styles/ 70 KB
11 KB 150ms
81ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-blog-extras/styles/style.min.css?ver=2.6.5

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

3fa3f0c4c099718595c4e25e55810cca92181c72d6233512fb51c2f74fa55cd7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:47 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"651e190b-1196f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: eb64e0e222296160f1dcdf3c39b5a08c
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/plugins/divi-blog-extras/styles/style.min.css?ver=2.6.5>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 style.min.css
p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-event-calendar-module/styles/ 80 KB
18 KB 161ms
92ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-event-calendar-module/styles/style.min.css?ver=1.0.0&wpr_t=1710308784

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

5e917f1351d67ffc9f20cf8e19ff3a2484b88cc216ccdf87b016348fd12d57fe

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:51:29
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Mar 2024 19:38:23 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65f0af2f-140d7"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 4ae9ebcc2eed90cff7f4d3ee0ee3ac5b
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-event-calendar-module/styles/style.min.css?ver=1.0.0&wpr_t=1710258686>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 style.min.css
www.horizon3.ai/wp-content/plugins/supreme-mega-menu/styles/ 86 KB
8 KB 152ms
150ms Stylesheet
text/css 104.197.16.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.horizon3.ai/wp-content/plugins/supreme-mega-menu/styles/style.min.css?ver=1.0.0

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.197.16.226 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

226.16.197.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

88b5e694b2cd2eb865f95f70bf0933c29172db94e7406a550a84c598cd107c89

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 05 Jan 2024 22:33:15 GMT
server: nginx
etag: W/"659883ab-1574b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()

GET
H2 200 style.min.css
p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-modules-pro-for-divi/styles/ 421 KB
31 KB 142ms
74ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-modules-pro-for-divi/styles/style.min.css?ver=4.9.93

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

d0606dcbe3bc47a9ff10d8bc52b0042c2040bed75c8382bcb534230aea248d3b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 Mar 2024 17:05:58 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ef39f6-69547"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 814f7087679704dc9a336cd79ad88443
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/plugins/supreme-modules-pro-for-divi/styles/style.min.css?ver=4.9.93>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 style.min.css
www.horizon3.ai/wp-content/plugins/supreme-mega-menu/styles/ 86 KB
8 KB 152ms
150ms Stylesheet
text/css 104.197.16.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.horizon3.ai/wp-content/plugins/supreme-mega-menu/styles/style.min.css?ver=1.2.5

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.197.16.226 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

226.16.197.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

88b5e694b2cd2eb865f95f70bf0933c29172db94e7406a550a84c598cd107c89

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 05 Jan 2024 22:33:15 GMT
server: nginx
etag: W/"659883ab-1574b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()

GET
H2 200 magnific_popup.css
p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/css/ 6 KB
3 KB 148ms
80ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/css/magnific_popup.css?ver=4.9.93

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

ca3af915877e0f119ce0df14dfce6249f76222c600e23882fa7c7f99788971cc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed1373-1946"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 24b23edf363a8e2bef9880fc19d488d4
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/css/magnific_popup.css?ver=4.9.93>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 swiper.css
p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-modules-pro-for-divi/public/css/ 22 KB
5 KB 149ms
81ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-modules-pro-for-divi/public/css/swiper.css?ver=4.9.93

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

c1b94e225b989e86f8b6c589c0778c17ec25d2465f33fd10dc7e2e45f060fa6c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 Mar 2024 17:05:58 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ef39f6-5865"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 578183b487b9dd4641f18ac6610116b4
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/plugins/supreme-modules-pro-for-divi/public/css/swiper.css?ver=4.9.93>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 popup.css
p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-modules-pro-for-divi/public/css/ 5 KB
2 KB 148ms
80ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-modules-pro-for-divi/public/css/popup.css?ver=4.9.93

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

2f1e0ba0f1a9560f8d67fb010c58f8995fa681625c321e18133ccec0043bce47

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 Mar 2024 17:05:58 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ef39f6-1389"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 9bf7e20b2b31a059af26d3bb52654aa0
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/plugins/supreme-modules-pro-for-divi/public/css/popup.css?ver=4.9.93>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 animate.css
p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-modules-pro-for-divi/public/css/ 83 KB
6 KB 147ms
79ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-modules-pro-for-divi/public/css/animate.css?ver=4.9.93

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

2414767fbf3e93d3269cb3795b6c667da0f58a8f662dfd8aabb0807243d1134f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 Mar 2024 17:05:58 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ef39f6-14d7b"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: e4125b9d15e1ddc92925c335851ec7a0
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/plugins/supreme-modules-pro-for-divi/public/css/animate.css?ver=4.9.93>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 readmore.css
p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-modules-pro-for-divi/public/css/ 2 KB
2 KB 118ms
51ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-modules-pro-for-divi/public/css/readmore.css?ver=4.9.93

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

009e58f3632270c3fa8d127a9e132807a0920ac00512a2a0c5f3e8d5d728d373

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1081
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 Mar 2024 17:05:58 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ef39f6-6bd"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: c767a2d31c621546f050f1f49823605c
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/plugins/supreme-modules-pro-for-divi/public/css/readmore.css?ver=4.9.93>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
p7i3u3x3.rocketcdn.me/wp-includes/js/jquery/ 86 KB
32 KB 148ms
80ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 28 Aug 2023 17:14:23 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"64ecd5ef-15601"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 2c353e129d79ae334f41208d367de806
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-includes/js/jquery/jquery.min.js?ver=3.7.1>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery-migrate.min.js Show response
p7i3u3x3.rocketcdn.me/wp-includes/js/jquery/ 13 KB
6 KB 149ms
81ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 09 Jun 2023 05:49:24 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"6482bd64-3509"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 09a5756eb006c281e7b0f6da93bf4cd5
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 aiwp-public.js Show response
p7i3u3x3.rocketcdn.me/wp-content/plugins/aiwp/public/js/ 913 B
2 KB 161ms
93ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/aiwp/public/js/aiwp-public.js?ver=2.0.0

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

2053ab9b2531576c619c6136fab9db876c237e61d6e0deaffe2969e52c5d1f67

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:48 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"651e190c-391"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: a2720d870ffc53761e24c2bbd4f41e02
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/plugins/aiwp/public/js/aiwp-public.js?ver=2.0.0>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 cookie-law-info-public.js Show response
p7i3u3x3.rocketcdn.me/wp-content/plugins/cookie-law-info/legacy/public/js/ 33 KB
9 KB 148ms
81ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/cookie-law-info/legacy/public/js/cookie-law-info-public.js?ver=3.2.0

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:58:24 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed13c0-8583"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 9f3c67986e1f765638cbe0fe30cfac74
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/plugins/cookie-law-info/legacy/public/js/cookie-law-info-public.js?ver=3.2.0>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 frontend.js Show response
p7i3u3x3.rocketcdn.me/wp-content/plugins/stop-user-enumeration/frontend/js/ 486 B
1 KB 148ms
81ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.4.9

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

8bbc0a7737643dd7c2344ba961592632153cb5353c92c5127339627e14b09143

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 18 Dec 2023 18:17:30 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65808cba-1e6"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 47aebc86b38c80d8feac28373791d96d
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.4.9>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 divi-filter-loadmore.min.js Show response
p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-ajax-filter/js/ 8 KB
4 KB 153ms
86ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-ajax-filter/js/divi-filter-loadmore.min.js?ver=3.1.6.1

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

3fecac074476b2081f0fdff03d66d02072029542362e7b6f7265c86c0d29c50b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 12 Feb 2024 02:00:34 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65c97bc2-2147"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: c5867107218a8f72335e13747fee5fef
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/plugins/divi-ajax-filter/js/divi-filter-loadmore.min.js?ver=3.1.6.1>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 et-divi-customizer-global.min.css
p7i3u3x3.rocketcdn.me/wp-content/et-cache/global/ 14 KB
5 KB 159ms
92ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1710179810

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

1b379c1412b4bee360acc84bfb51b37e7d8056272a2349083bf38a5e1bb9f1a3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:13
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 Mar 2024 17:56:50 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ef45e2-36ff"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 661850fc32e11b39940d58fed99394aa
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1710179810>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css
p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/ 80 KB
10 KB 158ms
92ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css?ver=1710181089&wpr_t=1710308785

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

f7c009a2574bfc517cbfea89d7f82e18e008e9aa518a4dc9450b777c34094d57

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/13/2024 10:13:26
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Mar 2024 20:11:12 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65f0b6e0-13fc8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 72e71f2dc0057963ed88df6f60b18443
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css?ver=1710181089&wpr_t=1710308785>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 js Show response
boards.greenhouse.io/embed/job_board/ 5 KB
2 KB 422ms
136ms Script
text/html 52.4.219.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://boards.greenhouse.io/embed/job_board/js?for=horizon3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.4.219.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-219-252.compute-1.amazonaws.com

Software

Resource Hash

ca6b4344f9f7607f872805d649e08b60c471d9a7ebba897f9f08bc07b16310fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

x-runtime: 0.010304
date: Wed, 13 Mar 2024 10:13:27 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
etag: W/"ca6b4344f9f7607f872805d649e08b60"
x-download-options: noopen
vary: Accept-Encoding
content-type: text/html; charset=utf-8
cache-control: max-age=0, private, must-revalidate
x-xss-protection: 1; mode=block
x-request-id: d0c55595b1d4bbef8e164cd5f5946ff8

GET
H2 200 mediaelementplayer-legacy.min.css
p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/ 11 KB
4 KB 56ms
52ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17&wpr_t=1710308785

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

8376feb9772b1ef54e7f8d859c72a1a16052d20e9c87ec23457ac4897fc9b1eb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1081
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:51:29
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Mar 2024 19:38:25 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65f0af31-2c4c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 57d971084770eea9355f94cd2ec7a452
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17&wpr_t=1710258687>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 wp-mediaelement.min.css
p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/ 4 KB
2 KB 67ms
64ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"5cfaccce-105a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 7aa5cf1c508f9e0245ccc95aa8dad675
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 bootstrap.min.css
p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-event-calendar-module/assets/css/ 13 KB
3 KB 58ms
55ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-event-calendar-module/assets/css/bootstrap.min.css?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

5617c251ed51f42797b789d282460813a798d8402a95cd633d3d8f0e82d44819

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:47 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"651e190b-35dd"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 788d744f71999eef340deae8cdd1e194
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/plugins/divi-event-calendar-module/assets/css/bootstrap.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 daterangepicker.css
cdn.jsdelivr.net/npm/daterangepicker/ 8 KB
2 KB 84ms
33ms Stylesheet
text/css 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/daterangepicker/daterangepicker.css?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

94fdb66ec8fe748981a4f2090fdf4a2a0a3dbe5ace2e65c4ce46e95d692bdac7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 26862
x-jsd-version: 3.1.0
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230032-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"1f85-jqRIojRLzDZKkujJKC/BWFh0US4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QH0%2FkkRPrQw%2FkpjxKLBuu8EXxcdo8J38jZBEPrUBKIaPFdzko%2FNwXgeGEvJ1zzUr%2FgeqnFpCVmWYe8uLVjVWhRnvqTWFEzJ%2FcwNzYW7%2BVErLRViDbQ8NRfj2KaOI1f%2F5mERC7ph5CX3WPv9%2FHiU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 863b40600ace0482-FRA

GET
H2 200 jquery-ui.css
p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/code.jquery.com/ui/1.13.2/themes/hot-sneaks/ 36 KB
10 KB 59ms
56ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/code.jquery.com/ui/1.13.2/themes/hot-sneaks/jquery-ui.css?ver=6.4.3&wpr_t=1710308785

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

d3fd8f6e5eb46bcff306dc795d69004a18703aaeb288f3c1d243125974b81c63

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:51:29
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Mar 2024 19:38:25 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65f0af31-8fec"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: f59b0c9737521d4f519a3f110ff56961
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/cache/background-css/code.jquery.com/ui/1.13.2/themes/hot-sneaks/jquery-ui.css?ver=6.4.3&wpr_t=1710258688>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 cookie-law-info-table.css
p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/plugins/cookie-law-info/legacy/public/css/ 6 KB
3 KB 59ms
56ms Stylesheet
text/css 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-table.css?ver=3.2.0&wpr_t=1710308785

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

d97b14988b87110e1e2feb141afb691fe9fa166fb87e723dfbf84070445de114

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:51:29
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Mar 2024 19:38:25 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65f0af31-17f4"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 0620d888751b53e1b709902df14742c5
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://www.horizon3.ai/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-table.css?ver=3.2.0&wpr_t=1710258688>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 scripts.min.js Show response
p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/js/ 268 KB
61 KB 58ms
55ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/js/scripts.min.js?ver=4.24.2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

9ccbe8ceae9d2553c597d0a65f19928d14f42368ddd1118d69a968c2c9912161

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed1373-42fa7"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: f24b6b7127638c12014e9b32a360582a
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/themes/Divi/js/scripts.min.js?ver=4.24.2>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery.fitvids.js Show response
p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 3 KB
2 KB 64ms
62ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.fitvids.js?ver=4.24.2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

462747422c6af30aa81a0373fa1cfd736455cef52bdbb816f67be9531d84eace

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1081
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed1373-d15"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 303a588f6b487129e8b8ccbb53d69147
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.fitvids.js?ver=4.24.2>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 comment-reply.min.js Show response
p7i3u3x3.rocketcdn.me/wp-includes/js/ 3 KB
2 KB 22ms
22ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-includes/js/comment-reply.min.js?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 08 Apr 2022 20:07:18 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"625095f6-ba5"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: fa3868493fddf3069ca2e0900d3eaa88
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-includes/js/comment-reply.min.js?ver=6.4.3>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery.mobile.js Show response
p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 8 KB
4 KB 58ms
56ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.mobile.js?ver=4.24.2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

55a084b5f4c439a2786141108b266370e0e4accc4e72629b2177dc6aa658d6c8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed1373-1f18"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 6f32955341f35fb86795c833102f12ae
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.mobile.js?ver=4.24.2>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 magnific-popup.js Show response
p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 22 KB
10 KB 59ms
56ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/magnific-popup.js?ver=4.24.2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

0a47c6e6f24e634cb79f886e70bbfd65e1e85b0d2aa4fc133488fd1bc1910e3e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed1373-5902"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 6f170b11cda3de748a0237175bc0ad14
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/magnific-popup.js?ver=4.24.2>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 easypiechart.js Show response
p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 9 KB
4 KB 64ms
62ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/easypiechart.js?ver=4.24.2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

5aa24e4ab926693e29ffb0d0ca1557141defd3ca61b3b4e7caebaa2fcd5bf327

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1081
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed1373-2466"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 3fa61bc9c86047718bdc2213367c07c4
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/easypiechart.js?ver=4.24.2>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 salvattore.js Show response
p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 8 KB
5 KB 59ms
57ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/salvattore.js?ver=4.24.2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

b6205029e1016596807b655c8f57818736a787e32ceb1407effa152ac3bb9380

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed1373-217e"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 3ac71e9b11e16db314521bfb2fb908b1
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/salvattore.js?ver=4.24.2>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 frontend-bundle.min.js Show response
p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-ajax-filter/scripts/ 699 B
2 KB 59ms
57ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-ajax-filter/scripts/frontend-bundle.min.js?ver=3.1.6.1

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

05c86a01cec19a9f9931163c42515adaab424be687667ef09f7d9b3cd0765cb5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 12 Feb 2024 02:00:34 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65c97bc2-2bb"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 26ca53e2d0abf76733437096aedcba39
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/plugins/divi-ajax-filter/scripts/frontend-bundle.min.js?ver=3.1.6.1>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 frontend-bundle.min.js Show response
p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-blog-extras/scripts/ 35 KB
8 KB 59ms
57ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-blog-extras/scripts/frontend-bundle.min.js?ver=2.6.5

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

fc28654bf4d567cdbc91b5089345699eb8fff900d723b6dc635631eb0cb26fe5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:48 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"651e190c-8dee"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: daf5562e1e4eecaca5570e7138418dfb
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/plugins/divi-blog-extras/scripts/frontend-bundle.min.js?ver=2.6.5>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 frontend-bundle.min.js Show response
p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-event-calendar-module/scripts/ 733 B
2 KB 59ms
57ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/divi-event-calendar-module/scripts/frontend-bundle.min.js?ver=1.0.0

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

74ca4b4a7f9ee76d71e312306ea01f5d0661796d4caa0a2170058d2a27ed328d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:47 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"651e190b-2dd"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 07c781d1bd76470552d08b61e655f7ae
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/plugins/divi-event-calendar-module/scripts/frontend-bundle.min.js?ver=1.0.0>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 new-tab.js Show response
p7i3u3x3.rocketcdn.me/wp-content/plugins/page-links-to/dist/ 24 KB
10 KB 64ms
62ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/page-links-to/dist/new-tab.js?ver=3.3.6

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

d455ab882af3a742e6c9680578e6a590681bda99e34847f550f1f41a7d167969

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:46 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"651e190a-609e"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 36456cce0e6b9eed5ba6da74eada2a49
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/plugins/page-links-to/dist/new-tab.js?ver=3.3.6>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 common.js Show response
p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/core/admin/js/ 1 KB
2 KB 59ms
57ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/core/admin/js/common.js?ver=4.24.2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed1373-53f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: d8e8a6dd94221bcb2b30fb8e0943e630
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/themes/Divi/core/admin/js/common.js?ver=4.24.2>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 mediaelement-and-player.min.js Show response
p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/ 154 KB
39 KB 59ms
58ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2.17

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

b15c3ea03d50c2430490e7416733a254feea4237bb60b54181bd3473ebe4149f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1081
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Sep 2022 14:21:11 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"6335a9d7-26935"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: ab358e70a9f47f25f9b5438fc4c91354
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2.17>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 mediaelement-migrate.min.js Show response
p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/ 1 KB
2 KB 65ms
63ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/mediaelement-migrate.min.js?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

6d161e98e47ae150b51211443eef37040fb6269dcf85ad2048548066dca99e6f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 08 Apr 2022 20:07:18 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"625095f6-4a7"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 4d0303bf52b7be2bbe7ebf3cd15ac1b3
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-includes/js/mediaelement/mediaelement-migrate.min.js?ver=6.4.3>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 wp-mediaelement.min.js Show response
p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/ 1 KB
2 KB 66ms
64ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-includes/js/mediaelement/wp-mediaelement.min.js?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

79cb399203843f65199bec32bc4abac5dfd20f141d3e4ec1424bf00c7108fa45

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 07 Feb 2023 16:00:42 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"63e275aa-453"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: de1b00e397df196c7df871d7209ae761
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-includes/js/mediaelement/wp-mediaelement.min.js?ver=6.4.3>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 moment.min.js Show response
cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.4/ 57 KB
17 KB 78ms
30ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.4/moment.min.js?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

081737985335af4be15fc676ed4ccc0703c7446c6b5cbc9317e40bcdc6428e5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 143752
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 16837
last-modified: Wed, 06 Jul 2022 23:03:56 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "62c614dc-41c5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y4ogFP9p6oR7dec5BOuLw5DgIvyckYen%2FRbCbHi3fT1YTAvteK79s6ckz3%2BVwV4cVKL%2F36HVL%2Fnta8zbIPtM%2BgdYrwpdH1aJ%2BLA2T7lAajGB7rNFas8gVAzYcJ90acdUKn%2B3inZ8OyJakT0z9%2B8EbFcr"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 863b406008941c8b-FRA
expires: Mon, 03 Mar 2025 10:13:27 GMT

GET
H2 200 daterangepicker.min.js Show response
cdn.jsdelivr.net/npm/daterangepicker/ 32 KB
8 KB 83ms
34ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/daterangepicker/daterangepicker.min.js?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

837f3f510b4be76f36c097ca94f9efe87c0a0581daf5e8b2bf980d9f3788bc37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 13041
x-jsd-version: 3.1.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-etou8220036-FRA, cache-lga21972-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"8092-XxjDQopdrufpJf5BZ3ADy4siD68"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=glxGhavmqr5nHBT4man3fvZs9M8gUfZ96%2BwfAJAlfXfIo2OeYrYKuxISo354RDTbf1l%2F4capSYgCmxuJRkRZivoH3TcqD6QkgRs5mh%2BaI8k2rgcfDQwveuEhVgWvbwt1vvoiCnyG2eDoKqStnuE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 863b40600ad30482-FRA

GET
H2 200 jquery-ui.js Show response
code.jquery.com/ui/1.13.2/ 517 KB
124 KB 71ms
22ms Script
application/javascript 2a04:4e42:600::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.13.2/jquery-ui.js?ver=6.4.3
Requested by: Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: c4b0fb9e123ad9f72c1192b6feff0bb0171be251bb76050b92e5e85c1fe3f757

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1728794
x-cache: HIT, HIT
content-length: 126267
x-served-by: cache-lga21926-LGA, cache-fra-eddf8230124-FRA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1710324808.682469,VS0,VE0
etag: W/"28feccc0-81307"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 60, 59933

GET
H2 200 loadFilter.js Show response
cdn.jsdelivr.net/gh/peeayecreative/dec-cdn@2.7.6/js/ 44 KB
6 KB 85ms
36ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/peeayecreative/dec-cdn@2.7.6/js/loadFilter.js?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0a9a22da3f67f5e35770bedef0e2ec034eddd871243a6b80d09b285372d1863

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 23688
x-jsd-version: 2.7.6
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230098-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"b08f-hyuFhPhDAFE5gn7UWPXhS1S5p0w"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bJY9vdQ0GEapZkEO4AXxUAIYHvy%2Bcq0cUjTDTpABLzm9dzyDLQ1xq7iP5M3szAtuU9LUDT9YAx1TWeAy8dj6%2FHTv8ZTek%2FrPMUh5GvVVW3IntXndkqxBRfNuBRAJMUnnYNTvvcxUXfPqxyFLZ88%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 863b40600ad60482-FRA

GET
H2 200 loadmore.js Show response
cdn.jsdelivr.net/gh/peeayecreative/dec-cdn@2.7.6/js/EventFeed/ 31 KB
5 KB 84ms
36ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/peeayecreative/dec-cdn@2.7.6/js/EventFeed/loadmore.js?ver=6.4.3

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0907683649854f8c34c1c89b06ac8256e5414e1c2db6019fa0c0f347e9e240e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 9775
x-jsd-version: 2.7.6
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230102-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"7b9e-g8xMzqvVKM5J7uC4u0KIn/Wvuw4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SQDTd0B6XgQFFTGuivhOKhzhA451tcXFwM1rQAk5tNBSgkAyyI1Nb5JeImnojDbqjurlIxs6z%2F27AbHGBxAQ%2B75IClGXdBZWlz%2F0Y7kZIkSnN5%2FygbcLj%2F6t1bCbyqZRedAVAiXnIvSHLX%2FIa%2Bg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 863b40600ada0482-FRA

GET
H2 200 frontend-bundle.min.js Show response
p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-mega-menu/scripts/ 7 KB
3 KB 64ms
63ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/supreme-mega-menu/scripts/frontend-bundle.min.js?ver=1.0.0

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

2ef47683a742d295a0b80db1d1d4822faee363458e67bc4b6a6a8d8c35a947d5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 05 Jan 2024 22:33:15 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"659883ab-1dee"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 892afceb0555d0f1bd93b4dd52a2fb58
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/plugins/supreme-mega-menu/scripts/frontend-bundle.min.js?ver=1.0.0>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 motion-effects.js Show response
p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 154 KB
39 KB 64ms
63ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/motion-effects.js?ver=4.24.2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

e51e19db4305a39866527982780d253af76c071540c09f2b215cab4b08de2b10

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1081
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed1373-26901"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 43ba85bd6cf3318d575965acbce318da
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/motion-effects.js?ver=4.24.2>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 sticky-elements.js Show response
p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 212 KB
60 KB 64ms
64ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/sticky-elements.js?ver=4.24.2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

f988466c42d1f2b5bb177b6221783d53b8ee21e9e3399c502ab3689f56fbc19e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1080
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:36
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65ed1373-34f33"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 8808eabf01afe6d92c1516528024fa4c
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/sticky-elements.js?ver=4.24.2>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 lazyload.min.js Show response
p7i3u3x3.rocketcdn.me/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/ 9 KB
4 KB 22ms
22ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
cdn-edgestorageid: 1082
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:37
cdn-pullzone: 1682947
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 12 Feb 2024 01:57:52 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"65c97b20-22bc"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 8a21e968646e874f576494f8a6fcfc3a
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 257 KB
89 KB 103ms
53ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

10656b9e62accd8b7c96079b2484f97f96e813bd7d0605d447a5ae5f0502f86a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 91133
x-xss-protection: 0
last-modified: Wed, 13 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 13 Mar 2024 10:13:27 GMT

GET
H2 200 tag.aspx Show response
ml314.com/ 33 KB
11 KB 93ms
25ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?132
Requested by: Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 825f6b61f96bc43809abd30cab948309377449c379a6f973c582f5d28bf267ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 09:26:12 GMT
via: 1.1 google
content-encoding: br
age: 2835
x-guploader-uploadid: ABPtcPpzktWxPjrHhLosTBoBwyfyw_BNgYPqZ-9yzCfCxsY-7GwFHd7BfQ0iz7l3ygalXPUacfc
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10671
last-modified: Wed, 21 Feb 2024 23:31:36 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-generation: 1708558296436903
x-goog-hash: crc32c=srF/gg==, md5=3fpNhUvHTpM0hkxhCmt/UA==
content-type: application/javascript
cache-id: FRA-fa985ced
cache-control: public,max-age=3600
x-cache-hit: hit
x-goog-stored-content-length: 34175
accept-ranges: bytes

GET
H2 200 61eaf806342d59001e8ed916 Show response
ws.zoominfo.com/pixel/ 3 KB
2 KB 310ms
250ms Script
text/javascript 2606:4700::6810:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/61eaf806342d59001e8ed916

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

a5c0ed984627d1aa3c16798d150f5fceb9d810104ae428a9c765f02e12db5a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400
cf-ray: 863b40613c692c47-FRA

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ec8b3f080d11709636b939addb9614ce19f953207889de7c966a5ad35ed88b03

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 10fe74c5486cb657045684650fa6bca57877d085fac26b0cfdebb96009006562

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8c5530ff3360befc4de68af263c1bbad146d87c46866e40a186d391dba96f58f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5cbc9df74e32accc8275e8bbeb2256df11a6319633af53552ac59abc3f4c871a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e9e0189269c94fe5406146305fa6666cc3f2187d9cce7dc774721152743d683

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 623cd0c501c1b24285f86c54ad4e46ce9766480d15d231741d76041329db26d8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 70 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b58a707a7e8ff6c776e134349157846d4b8c238f10bb7e26bbfd40eea881c4a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 950b6568f1a12451f7e42aac8af81e4cb78b763fc18a72a648352386d85e7598

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3c2390dcc40e9ae5ac0b1135ba9e413aae3907743fdcff2f1c58d4cab55852bd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e74478365f21b0e1ffba569cb4f710bb9326cf0ff7a695cf168af1b39751a1f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f9c0d901187b5db0f16fb694ee6ba505e3dae124a04411f4a145c24a18a0092

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f90df92bbf953b4b7e71269737d5e467601ac17bcc1b8bad02d18b34c2c80a3d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56a78bfadffb0ab21b93519798520f638bfc7269ae8a866a1a4d75c112efa8f6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a52a4324242f49a12ef9f51ad17ea00ac1a407949bfaf26688ac9003cd6845e5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1a6573f3119e669f076691dace74b1c2587a7904c59c90bdd186c4587ead4ff0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css
www.horizon3.ai/wp-content/et-cache/242851/ 170 KB
18 KB 155ms
155ms Stylesheet
text/css 104.197.16.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.horizon3.ai/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.197.16.226 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

226.16.197.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

4dea74288ba43d5f6c5de24977925baab55feac9a0c7861b86ecee6cb3001f3a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:27 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Mar 2024 15:25:04 GMT
server: nginx
etag: W/"65f073d0-2a9e0"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()

GET
H2 200 utsync.ashx Show response
ml314.com/ 62 B
254 B 44ms
44ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=81430&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F&pv=1710324807903_e2z2m27zx&bl=en-us&cb=5439471&return=&ht=&d=&dc=&si=1710324807903_e2z2m27zx&cid=6cde07f1-6e0d-4162-bf0a-d382a9285bc8&s=1600x1200&rp=&v=2.6.1.139
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?132
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Mar 2024 10:13:27 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
content-type: application/javascript
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 297 KB
95 KB 63ms
63ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-V462VSRXXS&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0253d5a2a6b6f5aaea3cf364a24bd7fc04619ca860ed4222e3985b3392ef9609

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 97009
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 13 Mar 2024 10:13:28 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 242 KB
84 KB 53ms
53ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-10792903506&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ed19ee41caf8684099e96e7775c2a8e487127e9f0cd5a64b03e104b4a27a4512

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85907
x-xss-protection: 0
last-modified: Wed, 13 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 13 Mar 2024 10:13:28 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 28 KB
9 KB 81ms
21ms Script
application/javascript 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 2939d067bced6e2e3e43c1b10d2b067cb980410c2cc42fd3e867798a4a36c697

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Feb 2024 20:38:48 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "9a680c8c475d8bba600d4d87b4fa7ee5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 8702

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 398ms
127ms Script
application/javascript 3.92.120.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.92.120.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-92-120-28.compute-1.amazonaws.com
Software: /
Resource Hash: 41402adfc915ad6dfd6328c06c8038763d25fe603e63beba4a2638a2bbc03136

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Wed, 13 Mar 2024 10:13:28 GMT
content-encoding: gzip
X-Pardot-Route: 16b0ab393667a33fe86adedc3141e88c
last-modified: Tue, 12 Mar 2024 05:25:20 GMT
etag: "15f4-gzip"
vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
cache-control: max-age=63072000
Connection: keep-alive
accept-ranges: bytes
Content-Length: 1988
expires: Fri, 13 Mar 2026 10:13:28 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 118ms
35ms Script
application/javascript 2a02:26f0:3500:16::215:148d
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

85a881fba590ac097d83e7d5397c82c99d9538ac482af8f10a3e5886393cfc85

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 11 Mar 2024 16:03:53 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=12430
accept-ranges: bytes
content-length: 17224

GET
H/1.1 200
OK PLwGhTJP Show response
io.clickguard.com/s/cHJvdGVjdG9y/ 8 KB
3 KB 203ms
149ms Script
application/javascript 2606:4700:20::681a:c98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://io.clickguard.com/s/cHJvdGVjdG9y/PLwGhTJP
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NXGBH9M
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:c98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 443d46f9d69f14a535cd97ede9509b34da652650b71e7c707455854c0f880eec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Wed, 13 Mar 2024 10:13:28 GMT
via: 1.1 google
Content-Encoding: br
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
x-powered-by: Express
etag: W/"1eaf-yhg3H7xrluyqMEcV9QjyiGI7kE8"
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s8wchCLyJTY86OxBfxSSdMBu9407zzGvpPHLScUrneMYMaUWJHNxBkcUAs820QtYTwZWBzcNrygnL%2Bu8WvjOT%2BZMswEMLXIKfJmPIOLzU%2BUx202xEBIkoaYdOI7IElPWPfWeBkpsTfANIssCz7fe"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript; charset=utf-8
access-control-allow-origin: *
Connection: keep-alive
CF-RAY: 863b40623cb465d9-FRA

GET
H2 200 dreamdata.min.js Show response
cdn.dreamdata.cloud/scripts/analytics/v1/ 127 KB
39 KB 79ms
25ms Script
text/javascript 34.120.220.80
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.dreamdata.cloud/scripts/analytics/v1/dreamdata.min.js

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.220.80 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

80.220.120.34.bc.googleusercontent.com

Software

UploadServer /

Resource Hash

8e78bcb85c5e969c9fbd74ade48ae59d1e8c94bc928b61947bab57c5f8576a54

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 09:51:37 GMT
content-encoding: gzip
strict-transport-security: max-age=63072000;includeSubdomains
age: 1311
x-guploader-uploadid: ABPtcPpvvi-Ce4_oH-hUTG7EwL9FVJFJ8TahqbRVWzh-Etfpc49Qb011vTVkDu4G6cq9zNJQ0xqbBtjNrg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39064
referrer-policy: origin
last-modified: Tue, 19 Dec 2023 15:12:09 GMT
server: UploadServer
etag: "5a0c242829201a80f498d4959d83ebfc"
vary: Accept-Encoding
x-goog-generation: 1702998729480704
x-goog-hash: crc32c=9JeVgg==, md5=WgwkKCkgGoD0mNSVnYPr/A==
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public,max-age=1800
x-goog-stored-content-length: 39064
accept-ranges: bytes
content-type: text/javascript; charset=utf-8
expires: Wed, 13 Mar 2024 10:21:37 GMT

GET
H2 200 identify-form.min.js Show response
cdn.dreamdata.cloud/scripts/identify-form/v1/ 17 KB
4 KB 102ms
48ms Script
text/javascript 34.120.220.80
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.dreamdata.cloud/scripts/identify-form/v1/identify-form.min.js

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.220.80 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

80.220.120.34.bc.googleusercontent.com

Software

UploadServer /

Resource Hash

329497ae402b18182303e3e893ec8ce8ad7a515ad2c8232857af0ff202296b80

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:00:04 GMT
content-encoding: gzip
strict-transport-security: max-age=63072000;includeSubdomains
age: 804
x-guploader-uploadid: ABPtcPpy-Iv-jsyv4hqhWeshdOhZwZOshnKVsOKfFwKYI5f_A0Qr0OndL98pPL5UG0XfKE_OvnQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4026
referrer-policy: origin
last-modified: Wed, 07 Feb 2024 14:20:59 GMT
server: UploadServer
etag: "9356f5b74975aa771e077e2715d20e45"
vary: Accept-Encoding
x-goog-generation: 1707315659022481
x-goog-hash: crc32c=51DaPQ==, md5=k1b1t0l1qnceB34nFdIORQ==
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=1800
x-goog-stored-content-length: 4026
accept-ranges: bytes
content-type: text/javascript; charset=utf-8
expires: Wed, 13 Mar 2024 10:30:04 GMT

GET
H2 200 t2_rwb6eefi_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
700 B 74ms
28ms XHR
application/json 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_rwb6eefi_telemetry
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-encoding: gzip
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
server: snooserv
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
content-length: 98

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 80ms
23ms Image
image/gif 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1710324808107&id=t2_rwb6eefi&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=9b9f57d1-c508-4ecb-9017-0ca66886d99a&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_c9439d84&dpm=&dpcc=&dprc=
Requested by: Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

POST
H2 204 collect
region1.analytics.google.com/g/ 0
254 B 80ms
29ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-V462VSRXXS&gtm=45je43b0v889089095z8852319646za200&_p=1710324807801&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1172808456.1710324808&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1710324808&sct=1&seg=0&dl=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F&dt=CVE-2024-0204%3A%20Fortra%20GoAnywhere%20MFT%20Authentication%20Bypass%20Deep-Dive%20%E2%80%93%20Horizon3.ai&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1472
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-V462VSRXXS&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Mar 2024 10:13:28 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.horizon3.ai
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
254 B 91ms
30ms Ping
text/plain 2a00:1450:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-V462VSRXXS&cid=1172808456.1710324808&gtm=45je43b0v889089095z8852319646za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-V462VSRXXS&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c06::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Mar 2024 10:13:28 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.horizon3.ai
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 98ms
47ms Image
image/gif 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-V462VSRXXS&cid=1172808456.1710324808&gtm=45je43b0v889089095z8852319646za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&z=1869203730

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Mar 2024 10:13:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 p Show response
cdn.dreamdata.cloud/api/v1/ 16 B
33 B 90ms
43ms XHR
application/json 34.120.220.80
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.dreamdata.cloud/api/v1/p

Requested by

Host: cdn.dreamdata.cloud
URL: https://cdn.dreamdata.cloud/scripts/analytics/v1/dreamdata.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.120.220.80 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

80.220.120.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;includeSubdomains

Request headers

Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
via: 1.1 google
referrer-policy: nosniff
strict-transport-security: max-age=63072000;includeSubdomains
server: Google Frontend
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: d0c9461848e6f9b02f0b69c80409b4a2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1710324808186&li_adsId=8e61cddc-2954-461c-aabc-816dd7abfe52&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1710324808186&li_adsId=8e61cddc-2954-461c-aabc-816dd7abfe52&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3527860%26time%3D1710324808186%26li_adsId%3D8e61cddc-2954-461c-aabc-816dd7abfe52%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1710324808186&li_adsId=8e61cddc-2954-461c-aabc-816dd7abfe52&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1710324808186&li_adsId=8e61cddc-2954-461c-aabc-816dd7abfe52&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve...

0
266 B

191ms
137ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1710324808186&li_adsId=8e61cddc-2954-461c-aabc-816dd7abfe52&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F&cookiesTest=true&liSync=true&e_ipv6=AQLiJagLJWK7wQAAAY43TXv_9cOW8WWCh_DPzcB7QSXmoeuVKOdKzPF4TgCxEptJ7aJTgt8s5ORJ
Requested by: Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: E0DE5F857B4F49B49ED0F4F8C2FB8345 Ref B: FRAEDGE1805 Ref C: 2024-03-13T10:13:28Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYTiAavBsKAj+1tQPZKRw==

Redirect headers

date: Wed, 13 Mar 2024 10:13:28 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 0BDA4CA9BDDA4F27A2D5983498823474 Ref B: FRAEDGE2020 Ref C: 2024-03-13T10:13:28Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3527860&time=1710324808186&li_adsId=8e61cddc-2954-461c-aabc-816dd7abfe52&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F&cookiesTest=true&liSync=true&e_ipv6=AQLiJagLJWK7wQAAAY43TXv_9cOW8WWCh_DPzcB7QSXmoeuVKOdKzPF4TgCxEptJ7aJTgt8s5ORJ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYTiAasP2M/5XT2OIF/uQ==

GET
H2 200 iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-2Y-FWUU1.woff2
fonts.gstatic.com/s/rubik/v28/ 25 KB
26 KB 79ms
27ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-2Y-FWUU1.woff2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b6b5794ed90f5d92c63d4bb9dc269e02e5c5140568997660213f8990bd76247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.horizon3.ai/
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Thu, 07 Mar 2024 14:27:13 GMT
x-content-type-options: nosniff
age: 503175
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25620
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 16:17:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Mar 2025 14:27:13 GMT

GET
H2 200 modules.woff
www.horizon3.ai/wp-content/themes/Divi/core/admin/fonts/modules/social/ 10 KB
11 KB 290ms
289ms Font
font/woff 104.197.16.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.horizon3.ai/wp-content/themes/Divi/core/admin/fonts/modules/social/modules.woff

Requested by

Host: p7i3u3x3.rocketcdn.me
URL: https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css?ver=1710256053

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.197.16.226 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

226.16.197.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

b4d9b5f545245d9781d491989a77089f380de3a58898ea70116cc59f61257e92

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

Referer: https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css?ver=1710256053
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 10320
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: nginx
etag: "65ed1373-2850"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUU1.woff2
fonts.gstatic.com/s/rubik/v28/ 25 KB
25 KB 127ms
75ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUU1.woff2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8189eb6330e9f0b62e4fe2be8bbad8129ebf1db97e390c2386e0b5a2880aa403

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.horizon3.ai/
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 09:01:03 GMT
x-content-type-options: nosniff
age: 90745
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25500
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 16:13:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Mar 2025 09:01:03 GMT

GET
H2 200 iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUU1.woff2
fonts.gstatic.com/s/rubik/v28/ 25 KB
25 KB 100ms
48ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUU1.woff2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46ed19e2d021296a35c1632b877c5fff1aa3c3eaec27d49d892e94545b792b43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.horizon3.ai/
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 06:41:40 GMT
x-content-type-options: nosniff
age: 99108
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25656
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 16:17:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Mar 2025 06:41:40 GMT

GET
H2 200 iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUU1.woff2
fonts.gstatic.com/s/rubik/v28/ 25 KB
25 KB 121ms
69ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUU1.woff2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fbf0d9704506b1ad0def13dc96bf24602d807afe597a754ae59fe1d2c0efcec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.horizon3.ai/
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 21:47:28 GMT
x-content-type-options: nosniff
age: 131160
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25320
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 16:18:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Mar 2025 21:47:28 GMT

GET
H2 200 fa-solid-900.woff2
www.horizon3.ai/wp-content/themes/Divi/core/admin/fonts/fontawesome/ 78 KB
79 KB 153ms
152ms Font
font/woff2 104.197.16.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.horizon3.ai/wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-solid-900.woff2

Requested by

Host: p7i3u3x3.rocketcdn.me
URL: https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css?ver=1710256053

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.197.16.226 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

226.16.197.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

6b555920e358f8a25a422988b448615c33bcccb4f932e8331cebfc8e2a737fc7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

Referer: https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css?ver=1710256053
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 80300
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: nginx
etag: "65ed1373-139ac"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 fa-brands-400.woff2
www.horizon3.ai/wp-content/themes/Divi/core/admin/fonts/fontawesome/ 77 KB
78 KB 268ms
268ms Font
font/woff2 104.197.16.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.horizon3.ai/wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-brands-400.woff2

Requested by

Host: p7i3u3x3.rocketcdn.me
URL: https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css?ver=1710256053

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.197.16.226 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

226.16.197.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

71b3ce72680f4183d28db86b184542051fd533bb1146933233e4f6a20cf98cba

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

Referer: https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css?ver=1710256053
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 78460
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: nginx
etag: "65ed1373-1327c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 S6uyw4BMUTPHjxAwXg.woff2
fonts.gstatic.com/s/lato/v24/ 25 KB
25 KB 135ms
83ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjxAwXg.woff2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

386a206aade080bb0045005cfdbb660430ed46d652039eef6bc299d54d7c43ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.horizon3.ai/
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 12 Mar 2024 00:05:31 GMT
x-content-type-options: nosniff
age: 122877
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25284
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:15 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Mar 2025 00:05:31 GMT

GET
H2 200 iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-WYiFWUU1.woff2
fonts.gstatic.com/s/rubik/v28/ 23 KB
23 KB 91ms
58ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-WYiFWUU1.woff2

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b305496a376155dbf4b51c26fc3d4ebca6083945fc20aa60c47817836f86366

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.horizon3.ai/
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 18:31:34 GMT
x-content-type-options: nosniff
age: 142914
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23316
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 16:13:32 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Mar 2025 18:31:34 GMT

GET
H2 200 Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png.webp
p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/06/ 13 KB
14 KB 39ms
37ms Image
image/webp 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/06/Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png.webp

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

70631b3ab478a15e8a26f17b8bb991464916725030d772237692c217e0d21334

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1081
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:14:38
cdn-pullzone: 1682947
content-length: 12820
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:36 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "651e1900-3214"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: fffcf7cb37032e36603a5fb7a2a2d519
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2022/06/Horizon3ai_Logo_Tagline_Horizontal_RGB-WhiteTxt.png.webp>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 Screenshot-2024-02-05-at-5.26.52-PM-980x473.png.webp
p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/02/ 18 KB
20 KB 31ms
29ms Image
image/webp 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/02/Screenshot-2024-02-05-at-5.26.52-PM-980x473.png.webp

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

742e0f5eab937214a0356e1a61f4ba94b2eb1b63a56547c4c7911a3852441d73

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1080
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:15
cdn-pullzone: 1682947
content-length: 18934
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 05 Feb 2024 22:27:14 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "65c160c2-49f6"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 1fe1fc276059b0cac01defeb0776b77c
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2024/02/Screenshot-2024-02-05-at-5.26.52-PM-980x473.png.webp>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 400x250-Award-Feature-Fortune-60-23.png.webp
p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/02/ 7 KB
8 KB 31ms
29ms Image
image/webp 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/02/400x250-Award-Feature-Fortune-60-23.png.webp

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

006c1f8041f43e8e88b21963a98606004c917f577d392853bd493febb3eb724a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1081
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:15
cdn-pullzone: 1682947
content-length: 7268
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 01 Feb 2024 21:28:51 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "65bc0d13-1c64"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 8e443a1677fddf4f5d5d43370f931623
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2024/02/400x250-Award-Feature-Fortune-60-23.png.webp>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 400x250-Award-CyberSecured.png.webp
p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/ 12 KB
13 KB 39ms
37ms Image
image/webp 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-CyberSecured.png.webp

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

92b1d0db841f621794d63c4b60d77fec89a356f08915a397884c3149c09d9436

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1080
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:15
cdn-pullzone: 1682947
content-length: 12530
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 03 Jan 2024 18:18:57 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "6595a511-30f2"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 79062ac7bac3341f1fe2d6246c1a5902
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2023/12/400x250-Award-CyberSecured.png.webp>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 400x250-Award-23-stellar-CRN.png.webp
p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/ 11 KB
13 KB 32ms
30ms Image
image/webp 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/12/400x250-Award-23-stellar-CRN.png.webp

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

e8d5a2b6cd6d5da72867558b6d057dfd10bff5cb5c01a63d537747f24dd3542d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1082
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:15
cdn-pullzone: 1682947
content-length: 11572
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 06 Dec 2023 20:53:45 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "6570df59-2d34"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 6e0b6e8e9754e5af8ea86035d53818f8
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2023/12/400x250-Award-23-stellar-CRN.png.webp>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 1200x627-Events-24-SecureWorld_Boston.jpg.webp
p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/02/ 55 KB
56 KB 58ms
56ms Image
image/webp 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/02/1200x627-Events-24-SecureWorld_Boston.jpg.webp

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

280c92900e1518c1e75865d2f2046862b608c1d0654fab54831394e3b7dd39a3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1082
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 23:06:25
cdn-pullzone: 1682947
content-length: 55852
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 28 Feb 2024 17:45:06 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "65df7122-da2c"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: d20929f696f81cd06e44178420e3747b
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2024/02/1200x627-Events-24-SecureWorld_Boston.jpg.webp>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 1200x627-Red-Team-Blog-%03Fortra-GoAnywhere-Deep-Dive.jpg
p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/ 32 KB
33 KB 34ms
33ms Image
image/jpeg 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/1200x627-Red-Team-Blog-%03Fortra-GoAnywhere-Deep-Dive.jpg

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

c8aea575d88435a40895d50312aa4048df9395415190c3658c20289113dc27dd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1080
x-powered-by: RocketCDN - b
cdn-cachedat: 03/13/2024 10:13:27
cdn-pullzone: 1682947
content-length: 32777
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 23 Jan 2024 20:37:30 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "65b0238a-8009"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 3464a639464e723fd8a4b3bee27e873b
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2024/01/1200x627-Red-Team-Blog-%03Fortra-GoAnywhere-Deep-Dive.jpg>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 Screenshot-2024-01-23-at-2.03.34%E2%80%AFPM.png.webp
p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/ 14 KB
16 KB 58ms
56ms Image
image/webp 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.03.34%E2%80%AFPM.png.webp

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

bcb3134c98f5c794aaaa1a2bfa76d82aeab869999200c4d3ba3ef15029c13732

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1082
x-powered-by: RocketCDN - b
cdn-cachedat: 03/13/2024 10:13:26
cdn-pullzone: 1682947
content-length: 14672
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 23 Jan 2024 19:07:43 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "65b00e7f-3950"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 900b390e4e6402cabe19393fd385edc9
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.03.34%E2%80%AFPM.png.webp>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 Screenshot-2024-01-23-at-2.11.13%E2%80%AFPM-768x233.png.webp
p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/ 36 KB
38 KB 33ms
32ms Image
image/webp 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.11.13%E2%80%AFPM-768x233.png.webp

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

502be1af293da9a5492a99bb41647884a5ba58cd775e027cd1795a29183c8f0c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1080
x-powered-by: RocketCDN - b
cdn-cachedat: 03/13/2024 10:13:27
cdn-pullzone: 1682947
content-length: 37154
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 23 Jan 2024 19:16:39 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "65b01097-9122"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: f23d18d31d120e2b0e3cd10d1413f595
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-2.11.13%E2%80%AFPM-768x233.png.webp>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 Screenshot-2024-01-23-at-3.26.37%E2%80%AFPM-2048x1130.png.webp
p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/ 236 KB
237 KB 35ms
34ms Image
image/webp 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.26.37%E2%80%AFPM-2048x1130.png.webp

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

af30e94c93345a4867ae264bbea933e1670cb65817732a7a9668f9708619d5e1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1080
x-powered-by: RocketCDN - b
cdn-cachedat: 03/13/2024 10:13:27
cdn-pullzone: 1682947
content-length: 241638
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 23 Jan 2024 20:27:52 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "65b02148-3afe6"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 8d019f76342543c58a330b6eeea765ba
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2024/01/Screenshot-2024-01-23-at-3.26.37%E2%80%AFPM-2048x1130.png.webp>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 Menu-BG-NodeZero-v2.png
p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/11/ 101 KB
103 KB 40ms
40ms Image
image/png 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/11/Menu-BG-NodeZero-v2.png

Requested by

Host: p7i3u3x3.rocketcdn.me
URL: https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css?ver=1710181089&wpr_t=1710308785

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

f677faa4afd9b8b4424f9021d8e6c09892ace736ca435ceaba00c6b030cc1846

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css?ver=1710181089&wpr_t=1710308785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1081
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:16
cdn-pullzone: 1682947
content-length: 103768
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 16 Nov 2023 00:52:55 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "655567e7-19558"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: d72bd1fedc58718d6fd2f61582934371
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2023/11/Menu-BG-NodeZero-v2.png>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 Topography-202F42.png
p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/02/ 323 KB
324 KB 45ms
45ms Image
image/png 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2023/02/Topography-202F42.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

ed7878fd7f2f2fe87ca020abda660abe6d3cf75a66a17dc4a4f601026c50c9fd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css?ver=1710181089&wpr_t=1710308785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1081
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:16
cdn-pullzone: 1682947
content-length: 330273
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:31 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "651e18fb-50a21"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: ddad3c24ca538cbd4ef25cc5905b6687
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2023/02/Topography-202F42.png>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 Red-Team-Blog-BG.jpg
p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/ 51 KB
53 KB 51ms
51ms Image
image/jpeg 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/Red-Team-Blog-BG.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

6555189a58cede3f19c2269dfa21e1e86734f122f0e190bfaaee35895dcbd9fe

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css?ver=1710181089&wpr_t=1710308785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1080
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 19:51:30
cdn-pullzone: 1682947
content-length: 52684
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:33 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "651e18fd-cdcc"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 6300c9168379e05c16ac800e90205efc
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2022/10/Red-Team-Blog-BG.jpg>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 Partner-Background_580px.png
p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/ 46 KB
47 KB 51ms
50ms Image
image/png 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/Partner-Background_580px.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

d637a14caf342a3c8eef9a02b7c9eab323d84f09ff829a7c474a4fe821826f6a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css?ver=1710181089&wpr_t=1710308785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1080
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:16
cdn-pullzone: 1682947
content-length: 46750
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:33 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "651e18fd-b69e"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 3581679ccdb5bdcca43e65f4d74af25d
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2022/10/Partner-Background_580px.png>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 General-Blog-BG.jpg
p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/ 10 KB
11 KB 59ms
59ms Image
image/jpeg 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/General-Blog-BG.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

678ec1395bee5cfbc785eaa6df80b44b3c43bec6cce1511c4e08150a33c88465

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css?ver=1710181089&wpr_t=1710308785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1081
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:16
cdn-pullzone: 1682947
content-length: 10324
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:33 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "651e18fd-2854"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 56ba5043776f6d2f96bae9053b851888
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2022/10/General-Blog-BG.jpg>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 Customer-Stories-Blog-BG2.jpg
p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/ 54 KB
55 KB 49ms
49ms Image
image/jpeg 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/10/Customer-Stories-Blog-BG2.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

5ac5aa6d1b8caefb431d203559d1407ff9a12ebedec1b5dbc6d57b81a31012a0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css?ver=1710181089&wpr_t=1710308785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1081
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:16
cdn-pullzone: 1682947
content-length: 54932
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:33 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "651e18fd-d694"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: 8a2200f17c6d311e7e59909d00329e43
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2022/10/Customer-Stories-Blog-BG2.jpg>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 events-bg-3.png
p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/06/ 131 KB
132 KB 58ms
58ms Image
image/png 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p7i3u3x3.rocketcdn.me/wp-content/uploads/2022/06/events-bg-3.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 / RocketCDN - b

Resource Hash

b7c7ca9c0163b256b5107fe5b84abd5c89a78ef251c7549516aceac95334db79

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p7i3u3x3.rocketcdn.me/wp-content/cache/background-css/p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-core-unified-tb-242536-tb-4381-tb-243092-deferred-242851.min.css?ver=1710181089&wpr_t=1710308785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-edgestorageid: 1082
x-powered-by: RocketCDN - b
cdn-cachedat: 03/12/2024 20:02:16
cdn-pullzone: 1682947
content-length: 133745
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 05 Oct 2023 02:01:36 GMT
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: "651e1900-20a71"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control: public, max-age=31919000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
cdn-requestid: cc704ad2dfc96aec729a6a85c5cf5f73
accept-ranges: bytes
cdn-requestcountrycode: DE
link: <https://www.horizon3.ai/wp-content/uploads/2022/06/events-bg-3.png>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 font
fonts.gstatic.com/l/ 33 KB
33 KB 25ms
22ms Font
text/html 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/l/font?kit=iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUUz&skey=cee854e66788286d&v=v28

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7284ff21382bc15010d5a9c9ca35f57007814f48e84cce466e89ef1869e90980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.horizon3.ai/
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:06:38 GMT
x-content-type-options: nosniff
age: 410
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="font.woff"; filename*=UTF-8''font.woff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33880
x-xss-protection: 0
last-modified: Fri, 30 Jun 2023 00:38:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
timing-allow-origin: *
expires: Wed, 13 Mar 2024 10:06:38 GMT

GET
H/1.1 200
OK analytics Show response
pi.pardot.com/ 1 KB
2 KB 571ms
571ms Script
text/javascript 3.92.120.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=17120&account_id=972073&title=CVE-2024-0204%3A%20Fortra%20GoAnywhere%20MFT%20Authentication%20Bypass%20Deep-Dive%20%E2%80%93%20Horizon3.ai&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F&referrer=

Requested by

Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

3.92.120.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-92-120-28.compute-1.amazonaws.com

Software

Resource Hash

e2eec7d03715bcf1bd3d2a8e8656c2c27d061dbb4de6edaf054de649c383e625

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
Date: Wed, 13 Mar 2024 10:13:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Pardot-Route: 9b06e8e2308c32c7bf9ba8adfb7be2e1
x-pardot-rsp: 0/0/1
vary: Accept-Encoding,User-Agent
Content-Type: text/javascript; charset=utf-8
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Length: 536
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H3 200 iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUUw.ttf
fonts.gstatic.com/s/rubik/v28/ 68 KB
36 KB 24ms
23ms Font
font/ttf 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUUw.ttf

Requested by

Host: www.horizon3.ai
URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

977b03a17e6c623ab63583f72b1639b1ad6aef1ae044993c66b4c8328e571272

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.horizon3.ai/
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 11 Mar 2024 14:09:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158652
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37076
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 16:13:32 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Mar 2025 14:09:16 GMT

POST
H/1.1 200
OK PLwGhTJP Show response
pulse.clickguard.com/r/cHJvdGVjdG9y/ 0
590 B 163ms
163ms XHR
text/plain 2606:4700:20::ac43:44c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pulse.clickguard.com/r/cHJvdGVjdG9y/PLwGhTJP
Requested by: Host: io.clickguard.com
URL: https://io.clickguard.com/s/cHJvdGVjdG9y/PLwGhTJP
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:44c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Date: Wed, 13 Mar 2024 10:13:28 GMT
via: 1.1 google
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
x-powered-by: Express
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=im4zy6LVuos3fpHkLLyP4LMPODQY%2BIZdEahpSWlu5nPVAi16BtDhl2YWvnZpNZE6a93mL2kRzAe%2FPMcH8D8k8x2oTJ7ZVOOc8DkrBet9JTxt5hiTynR1w3zRa0eGs9DTNKhkqfmzEKkCLEZUktLVkF%2B4"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
Connection: keep-alive
CF-RAY: 863b40670fc85d90-FRA
Content-Length: 0

OPTIONS
H/1.1 204
No Content PLwGhTJP
pulse.clickguard.com/r/cHJvdGVjdG9y/ 0
0 291ms
195ms Preflight 2606:4700:20::ac43:44c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pulse.clickguard.com/r/cHJvdGVjdG9y/PLwGhTJP
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:44c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.horizon3.ai
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 863b4065de4f5d90-FRA
Connection: keep-alive
Content-Length: 0
Date: Wed, 13 Mar 2024 10:13:28 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OlQn6yigZrPoDxa4%2BuEXBZpm2FwU9wLQxWvP9Ccn5hVRNu%2FhjWrXzPJQSdgKTjJrBZcgTtc2RrIokLjH%2F6M3N5Oz2HAIFk086FhsG5CDuNtQ%2Bd9XSDTO3j2p7lru1A8ldPfTxaCrE33NSXKQBse0GXmf"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
vary: Access-Control-Request-Headers
via: 1.1 google
x-powered-by: Express

GET
H2 200 modules.woff
www.horizon3.ai/wp-content/themes/Divi/core/admin/fonts/modules/all/ 90 KB
91 KB 141ms
141ms Font
font/woff 104.197.16.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.horizon3.ai/wp-content/themes/Divi/core/admin/fonts/modules/all/modules.woff

Requested by

Host: p7i3u3x3.rocketcdn.me
URL: https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css?ver=1710256053

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.197.16.226 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

226.16.197.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

fe67b77ac7e0ef4b482dafb86adfa403db1b89a2f337d2dc8bd1278cfe975196

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

Referer: https://p7i3u3x3.rocketcdn.me/wp-content/et-cache/242851/et-divi-dynamic-tb-242536-tb-4381-tb-243092-242851-late.css?ver=1710256053
Origin: https://www.horizon3.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 92084
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 10 Mar 2024 01:57:07 GMT
server: nginx
etag: "65ed1373-167b4"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
accept-ranges: bytes

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
211 B 130ms
130ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 13 Mar 2024 10:13:28 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: F21435D19E7F4EC1A99036F99AECCDF1 Ref B: FRAEDGE2020 Ref C: 2024-03-13T10:13:28Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://www.horizon3.ai
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYTiAaxI8oxQbyN4OI3JA==

GET
H/1.1 200
OK analytics Show response
go.horizon3.ai/ 50 B
1020 B 520ms
271ms Script
text/javascript 3.92.120.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://go.horizon3.ai/analytics?conly=true&visitor_id=108142527&visitor_id_sign=5afbfd843b1f181bd14278be235caa8b84de37eb13fabd233e80225e44e832177d7d89929860e2df805ba48bc64e50536047300d&pi_opt_in=&campaign_id=17120&account_id=972073&title=CVE-2024-0204:%20Fortra%20GoAnywhere%20MFT%20Authentication%20Bypass%20Deep-Dive%20%E2%80%93%20Horizon3.ai&url=https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=17120&account_id=972073&title=CVE-2024-0204%3A%20Fortra%20GoAnywhere%20MFT%20Authentication%20Bypass%20Deep-Dive%20%E2%80%93%20Horizon3.ai&url=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F&referrer=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.92.120.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-92-120-28.compute-1.amazonaws.com
Software: /
Resource Hash: dcf430710cdd1359115293f45d5023b2a560aef8a2c1e59d578b8b1e10a216d3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
Date: Wed, 13 Mar 2024 10:13:29 GMT
X-Pardot-Route: 9b06e8e2308c32c7bf9ba8adfb7be2e1
x-pardot-rsp: 0/0/1
vary: User-Agent
Content-Type: text/javascript; charset=utf-8
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Length: 50
expires: Thu, 19 Nov 1981 08:52:00 GMT

POST
H2 200 admin-ajax.php Show response
www.horizon3.ai/wp-admin/ 3 KB
2 KB 338ms
337ms XHR
text/html 104.197.16.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.horizon3.ai/wp-admin/admin-ajax.php

Requested by

Host: p7i3u3x3.rocketcdn.me
URL: https://p7i3u3x3.rocketcdn.me/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.197.16.226 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

226.16.197.104.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

a7d719fdf58ac09e5bec20d8ee83316cfae49d774a9640290c9f985be0304c22

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Request headers

Accept: */*
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 13 Mar 2024 10:13:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-powered-by: WP Engine
content-length: 917
x-xss-protection: "1; mode=block"
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.horizon3.ai
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), layout-animations=(), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), vertical-scroll=(), vr=(), wake-lock=(), web-share=(), xr-spatial-tracking=()
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 29ms
29ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-V462VSRXXS&gtm=45je43b0v889089095za200&_p=1710324807801&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1172808456.1710324808&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AEA&_s=2&sid=1710324808&sct=1&seg=0&dl=https%3A%2F%2Fwww.horizon3.ai%2Fattack-research%2Fattack-blogs%2Fcve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive%2F&dt=CVE-2024-0204%3A%20Fortra%20GoAnywhere%20MFT%20Authentication%20Bypass%20Deep-Dive%20%E2%80%93%20Horizon3.ai&en=scroll&epn.percent_scrolled=90&_et=30&tfd=6504
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-V462VSRXXS&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Mar 2024 10:13:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.horizon3.ai
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

195 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.horizon3.ai/	1970-01-20 21:15:00	Name: _gcl_au Value: 1.1.1701552954.1710324808
.horizon3.ai/	1970-01-20 21:15:00	Name: _rdt_uuid Value: 1710324808106.9b9f57d1-c508-4ecb-9017-0ca66886d99a
.ws.zoominfo.com/	1970-01-21 03:51:00	Name: visitorId Value: 871e64f51b4df13593c3de28ee3ae789d661740533f05ee23bc744e6ee20650d
.zoominfo.com/	1970-01-20 19:05:26	Name: __cf_bm Value: ESjCgIvpysB84iXGUTu5pjGTm19GTv89NNEiXJ2wr5Y-1710324808-1.0.1.1-YxeUFr9FTkPsMI8JY82Zm1YrLQSrWbvODJaO0JbtrynrVBvamXY2_hNsJi8o_xj5za70OSrZZsbG4uQtsIjQmQ
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: amFakM_JKS97KN40RrugaAUclEdh7Vr_yyiAYsEo4yk-1710324808102-0.0.1.1-604800000
.horizon3.ai/	1970-01-21 04:41:24	Name: _ga Value: GA1.1.1172808456.1710324808
.horizon3.ai/	1970-01-21 03:51:00	Name: ajs_user_id Value: null
.horizon3.ai/	1970-01-21 03:51:00	Name: ajs_group_id Value: null
.horizon3.ai/	1970-01-21 03:51:00	Name: ajs_anonymous_id Value: %22da1651ba-d935-4c15-a327-f3aeb53480bf%22
.horizon3.ai/	1970-01-21 04:41:24	Name: _ga_V462VSRXXS Value: GS1.1.1710324808.1.0.1710324808.60.0.0
www.horizon3.ai/	1970-01-21 03:51:00	Name: cookielawinfo-checkbox-necessary Value: yes
www.horizon3.ai/	1970-01-21 03:51:00	Name: cookielawinfo-checkbox-functional Value: no
www.horizon3.ai/	1970-01-21 03:51:00	Name: cookielawinfo-checkbox-performance Value: no
www.horizon3.ai/	1970-01-21 03:51:00	Name: cookielawinfo-checkbox-analytics Value: no
www.horizon3.ai/	1970-01-21 03:51:00	Name: cookielawinfo-checkbox-advertisement Value: no
www.horizon3.ai/	1970-01-21 03:51:00	Name: cookielawinfo-checkbox-others Value: no
.linkedin.com/	1970-01-20 21:15:00	Name: li_sugr Value: 7c875201-f4c3-4bde-8f6c-8dd818658bb5
.linkedin.com/	1970-01-21 03:51:00	Name: bcookie Value: "v=2&410406e5-9ec8-443e-8d1c-221174f35e68"
.linkedin.com/	1970-01-20 19:06:51	Name: lidc Value: "b=VGST09:s=V:r=V:a=V:p=V:g=2825:u=1:x=1:i=1710324808:t=1710411208:v=2:sig=AQHnfJQFxltIm9w0E8D80_dSXBloaY-G"
.linkedin.com/	1970-01-20 19:48:36	Name: UserMatchHistory Value: AQLlNzNUSxQSNQAAAY43TXrqmGlQXJf_8MNIbZ65Y08IPqmxgOjHtNawyY0MjlyzX0EfZfE-Ixinyw
.linkedin.com/	1970-01-20 19:48:36	Name: AnalyticsSyncHistory Value: AQJ0ScWG4bHEJgAAAY43TXrqeKypExWBKIDY_QuuevFFXozGAMy3vpHImyJho2SNkqDrHhrObKacLy52ofmy5g
.www.linkedin.com/	1970-01-21 03:51:00	Name: bscookie Value: "v=1&20240313101328a4a66875-f55b-4786-8387-5d4e99741850AQFN6rEumSb7kzV14S8VbIUw0LEuZkfM"
.linkedin.com/	1970-01-20 23:24:36	Name: li_gc Value: MTswOzE3MTAzMjQ4MDg7MjswMjHBOFt0gfVceZtDnygoU43sX7VzbWj+rLvMufckzkPeBw==
.pardot.com/	1970-01-21 04:41:24	Name: visitor_id971073 Value: 108142527
.pardot.com/	1970-01-21 04:41:24	Name: visitor_id971073-hash Value: 5afbfd843b1f181bd14278be235caa8b84de37eb13fabd233e80225e44e832177d7d89929860e2df805ba48bc64e50536047300d
pi.pardot.com/	1970-01-20 19:05:26	Name: lpv971073 Value: aHR0cHM6Ly93d3cuaG9yaXpvbjMuYWkvYXR0YWNrLXJlc2VhcmNoL2F0dGFjay1ibG9ncy9jdmUtMjAyNC0wMjA0LWZvcnRyYS1nb2FueXdoZXJlLW1mdC1hdXRoZW50aWNhdGlvbi1ieXBhc3MtZGVlcC1kaXZlLw%3D%3D
www.horizon3.ai/	1970-01-21 04:41:24	Name: visitor_id971073 Value: 108142527
www.horizon3.ai/	1970-01-21 04:41:24	Name: visitor_id971073-hash Value: 5afbfd843b1f181bd14278be235caa8b84de37eb13fabd233e80225e44e832177d7d89929860e2df805ba48bc64e50536047300d
go.horizon3.ai/	1970-01-21 04:41:24	Name: visitor_id971073 Value: 108142527
go.horizon3.ai/	1970-01-21 04:41:24	Name: visitor_id971073-hash Value: 5afbfd843b1f181bd14278be235caa8b84de37eb13fabd233e80225e44e832177d7d89929860e2df805ba48bc64e50536047300d

54 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'battery'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'document-domain'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'execution-while-not-rendered'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'execution-while-out-of-viewport'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'layout-animations'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'legacy-image-formats'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'navigation-override'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'oversized-images'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'vertical-scroll'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'vr'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'wake-lock'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'web-share'.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/(Line 4119) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/(Line 4119) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/(Line 4119) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	"1; mode=block"

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alb.reddit.com
boards.greenhouse.io
cdn.dreamdata.cloud
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
fonts.gstatic.com
go.horizon3.ai
io.clickguard.com
ml314.com
p7i3u3x3.rocketcdn.me
pi.pardot.com
pulse.clickguard.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
snap.licdn.com
stats.g.doubleclick.net
ws.zoominfo.com
www.google.de
www.googletagmanager.com
www.horizon3.ai
www.linkedin.com
www.redditstatic.com
104.197.16.226
13.107.42.14
151.101.65.140
2001:4860:4802:32::36
2400:52e0:1e00::1082:1
2606:4700:20::681a:c98
2606:4700:20::ac43:44c4
2606:4700::6810:5814
2606:4700::6810:880f
2606:4700::6811:190e
2620:1ec:21::14
2a00:1450:4001:809::2003
2a00:1450:4001:811::2003
2a00:1450:4001:829::2008
2a00:1450:400c:c06::9b
2a02:26f0:3500:16::215:148d
2a04:4e42:200::396
2a04:4e42:600::649
3.92.120.28
34.117.77.79
34.120.220.80
52.4.219.252
006c1f8041f43e8e88b21963a98606004c917f577d392853bd493febb3eb724a
0085adfd2d08a45f62a06d8f3f969ddc4a94ebe8d226511db90aa038f11ed180
009e58f3632270c3fa8d127a9e132807a0920ac00512a2a0c5f3e8d5d728d373
0253d5a2a6b6f5aaea3cf364a24bd7fc04619ca860ed4222e3985b3392ef9609
05c86a01cec19a9f9931163c42515adaab424be687667ef09f7d9b3cd0765cb5
081737985335af4be15fc676ed4ccc0703c7446c6b5cbc9317e40bcdc6428e5d
0907683649854f8c34c1c89b06ac8256e5414e1c2db6019fa0c0f347e9e240e6
0a47c6e6f24e634cb79f886e70bbfd65e1e85b0d2aa4fc133488fd1bc1910e3e
10656b9e62accd8b7c96079b2484f97f96e813bd7d0605d447a5ae5f0502f86a
10fe74c5486cb657045684650fa6bca57877d085fac26b0cfdebb96009006562
1a6573f3119e669f076691dace74b1c2587a7904c59c90bdd186c4587ead4ff0
1b379c1412b4bee360acc84bfb51b37e7d8056272a2349083bf38a5e1bb9f1a3
1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea
1dbc030edb44538250da49a7541e946f8434cbe20598e5e85d384471428f1862
1f9c0d901187b5db0f16fb694ee6ba505e3dae124a04411f4a145c24a18a0092
2053ab9b2531576c619c6136fab9db876c237e61d6e0deaffe2969e52c5d1f67
2414767fbf3e93d3269cb3795b6c667da0f58a8f662dfd8aabb0807243d1134f
280c92900e1518c1e75865d2f2046862b608c1d0654fab54831394e3b7dd39a3
2939d067bced6e2e3e43c1b10d2b067cb980410c2cc42fd3e867798a4a36c697
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
2ef47683a742d295a0b80db1d1d4822faee363458e67bc4b6a6a8d8c35a947d5
2f1e0ba0f1a9560f8d67fb010c58f8995fa681625c321e18133ccec0043bce47
329497ae402b18182303e3e893ec8ce8ad7a515ad2c8232857af0ff202296b80
386a206aade080bb0045005cfdbb660430ed46d652039eef6bc299d54d7c43ed
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791
3c2390dcc40e9ae5ac0b1135ba9e413aae3907743fdcff2f1c58d4cab55852bd
3d9f625292ecba053f6254edbfef51e940c198ab41e23ff4382b340df3d605bd
3fa3f0c4c099718595c4e25e55810cca92181c72d6233512fb51c2f74fa55cd7
3fecac074476b2081f0fdff03d66d02072029542362e7b6f7265c86c0d29c50b
41402adfc915ad6dfd6328c06c8038763d25fe603e63beba4a2638a2bbc03136
443d46f9d69f14a535cd97ede9509b34da652650b71e7c707455854c0f880eec
462747422c6af30aa81a0373fa1cfd736455cef52bdbb816f67be9531d84eace
46ed19e2d021296a35c1632b877c5fff1aa3c3eaec27d49d892e94545b792b43
4dea74288ba43d5f6c5de24977925baab55feac9a0c7861b86ecee6cb3001f3a
502be1af293da9a5492a99bb41647884a5ba58cd775e027cd1795a29183c8f0c
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a
55a084b5f4c439a2786141108b266370e0e4accc4e72629b2177dc6aa658d6c8
5617c251ed51f42797b789d282460813a798d8402a95cd633d3d8f0e82d44819
56a78bfadffb0ab21b93519798520f638bfc7269ae8a866a1a4d75c112efa8f6
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5aa24e4ab926693e29ffb0d0ca1557141defd3ca61b3b4e7caebaa2fcd5bf327
5ac5aa6d1b8caefb431d203559d1407ff9a12ebedec1b5dbc6d57b81a31012a0
5b6b5794ed90f5d92c63d4bb9dc269e02e5c5140568997660213f8990bd76247
5cbc9df74e32accc8275e8bbeb2256df11a6319633af53552ac59abc3f4c871a
5e74478365f21b0e1ffba569cb4f710bb9326cf0ff7a695cf168af1b39751a1f
5e917f1351d67ffc9f20cf8e19ff3a2484b88cc216ccdf87b016348fd12d57fe
623cd0c501c1b24285f86c54ad4e46ce9766480d15d231741d76041329db26d8
6555189a58cede3f19c2269dfa21e1e86734f122f0e190bfaaee35895dcbd9fe
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db
678ec1395bee5cfbc785eaa6df80b44b3c43bec6cce1511c4e08150a33c88465
6b555920e358f8a25a422988b448615c33bcccb4f932e8331cebfc8e2a737fc7
6b58a707a7e8ff6c776e134349157846d4b8c238f10bb7e26bbfd40eea881c4a
6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f
6d161e98e47ae150b51211443eef37040fb6269dcf85ad2048548066dca99e6f
70631b3ab478a15e8a26f17b8bb991464916725030d772237692c217e0d21334
71b3ce72680f4183d28db86b184542051fd533bb1146933233e4f6a20cf98cba
7284ff21382bc15010d5a9c9ca35f57007814f48e84cce466e89ef1869e90980
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5
742e0f5eab937214a0356e1a61f4ba94b2eb1b63a56547c4c7911a3852441d73
74ca4b4a7f9ee76d71e312306ea01f5d0661796d4caa0a2170058d2a27ed328d
79cb399203843f65199bec32bc4abac5dfd20f141d3e4ec1424bf00c7108fa45
8189eb6330e9f0b62e4fe2be8bbad8129ebf1db97e390c2386e0b5a2880aa403
825f6b61f96bc43809abd30cab948309377449c379a6f973c582f5d28bf267ab
8376feb9772b1ef54e7f8d859c72a1a16052d20e9c87ec23457ac4897fc9b1eb
837f3f510b4be76f36c097ca94f9efe87c0a0581daf5e8b2bf980d9f3788bc37
85a881fba590ac097d83e7d5397c82c99d9538ac482af8f10a3e5886393cfc85
88b5e694b2cd2eb865f95f70bf0933c29172db94e7406a550a84c598cd107c89
8bbc0a7737643dd7c2344ba961592632153cb5353c92c5127339627e14b09143
8c5530ff3360befc4de68af263c1bbad146d87c46866e40a186d391dba96f58f
8e78bcb85c5e969c9fbd74ade48ae59d1e8c94bc928b61947bab57c5f8576a54
8e9e0189269c94fe5406146305fa6666cc3f2187d9cce7dc774721152743d683
92b1d0db841f621794d63c4b60d77fec89a356f08915a397884c3149c09d9436
94fdb66ec8fe748981a4f2090fdf4a2a0a3dbe5ace2e65c4ce46e95d692bdac7
950b6568f1a12451f7e42aac8af81e4cb78b763fc18a72a648352386d85e7598
977b03a17e6c623ab63583f72b1639b1ad6aef1ae044993c66b4c8328e571272
9b305496a376155dbf4b51c26fc3d4ebca6083945fc20aa60c47817836f86366
9ccbe8ceae9d2553c597d0a65f19928d14f42368ddd1118d69a968c2c9912161
a52a4324242f49a12ef9f51ad17ea00ac1a407949bfaf26688ac9003cd6845e5
a5c0ed984627d1aa3c16798d150f5fceb9d810104ae428a9c765f02e12db5a64
a73567cca36667ab843bd6a8ac3edd2078106a81dc96cb783b3e028f9d2ad0c5
a7d719fdf58ac09e5bec20d8ee83316cfae49d774a9640290c9f985be0304c22
af30e94c93345a4867ae264bbea933e1670cb65817732a7a9668f9708619d5e1
b0a9a22da3f67f5e35770bedef0e2ec034eddd871243a6b80d09b285372d1863
b15c3ea03d50c2430490e7416733a254feea4237bb60b54181bd3473ebe4149f
b4d9b5f545245d9781d491989a77089f380de3a58898ea70116cc59f61257e92
b6205029e1016596807b655c8f57818736a787e32ceb1407effa152ac3bb9380
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
b7c7ca9c0163b256b5107fe5b84abd5c89a78ef251c7549516aceac95334db79
bcb3134c98f5c794aaaa1a2bfa76d82aeab869999200c4d3ba3ef15029c13732
c1b94e225b989e86f8b6c589c0778c17ec25d2465f33fd10dc7e2e45f060fa6c
c4b0fb9e123ad9f72c1192b6feff0bb0171be251bb76050b92e5e85c1fe3f757
c8aea575d88435a40895d50312aa4048df9395415190c3658c20289113dc27dd
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
ca3af915877e0f119ce0df14dfce6249f76222c600e23882fa7c7f99788971cc
ca6b4344f9f7607f872805d649e08b60c471d9a7ebba897f9f08bc07b16310fe
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
d0606dcbe3bc47a9ff10d8bc52b0042c2040bed75c8382bcb534230aea248d3b
d3fd8f6e5eb46bcff306dc795d69004a18703aaeb288f3c1d243125974b81c63
d455ab882af3a742e6c9680578e6a590681bda99e34847f550f1f41a7d167969
d637a14caf342a3c8eef9a02b7c9eab323d84f09ff829a7c474a4fe821826f6a
d97b14988b87110e1e2feb141afb691fe9fa166fb87e723dfbf84070445de114
dcf430710cdd1359115293f45d5023b2a560aef8a2c1e59d578b8b1e10a216d3
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e2eec7d03715bcf1bd3d2a8e8656c2c27d061dbb4de6edaf054de649c383e625
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e51e19db4305a39866527982780d253af76c071540c09f2b215cab4b08de2b10
e8d5a2b6cd6d5da72867558b6d057dfd10bff5cb5c01a63d537747f24dd3542d
ec8b3f080d11709636b939addb9614ce19f953207889de7c966a5ad35ed88b03
ed19ee41caf8684099e96e7775c2a8e487127e9f0cd5a64b03e104b4a27a4512
ed7878fd7f2f2fe87ca020abda660abe6d3cf75a66a17dc4a4f601026c50c9fd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a
f677faa4afd9b8b4424f9021d8e6c09892ace736ca435ceaba00c6b030cc1846
f7c009a2574bfc517cbfea89d7f82e18e008e9aa518a4dc9450b777c34094d57
f90df92bbf953b4b7e71269737d5e467601ac17bcc1b8bad02d18b34c2c80a3d
f988466c42d1f2b5bb177b6221783d53b8ee21e9e3399c502ab3689f56fbc19e
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4
fbf0d9704506b1ad0def13dc96bf24602d807afe597a754ae59fe1d2c0efcec4
fc28654bf4d567cdbc91b5089345699eb8fff900d723b6dc635631eb0cb26fe5
fe67b77ac7e0ef4b482dafb86adfa403db1b89a2f337d2dc8bd1278cfe975196

www.horizon3.ai Open in urlscan Pro 104.197.16.226 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

113 Requests

99 %HTTPS

68 %IPv6

20 Domains

24 Subdomains

23 IPs

3 Countries

2762 kBTransfer

6538 kBSize

30 Cookies

28 Outgoing links

Page URL History

Redirected requests

113 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 17 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.horizon3.ai Open in urlscan Pro
104.197.16.226 Public Scan

Screenshot
Live screenshot

Full Image

113
Requests

99 %
HTTPS

68 %
IPv6

20
Domains

24
Subdomains

23
IPs

3
Countries

2762 kB
Transfer

6538 kB
Size

30
Cookies

113 HTTP transactions
17 data transactions