www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f77d Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Submission: On June 19 via api (June 19th 2020, 7:53:04 am UTC) from DE

Summary HTTP 92 Redirects Links 26 Behaviour Indicators

Summary

This website contacted 45 IPs in 9 countries across 42 domains to perform 92 HTTP transactions. The main IP is 2606:4700:300b::a29f:f77d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.fireeye.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on December 11th 2019. Valid for: 10 months.

This is the only time www.fireeye.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
23	2606:4700:300... 2606:4700:300b::a29f:f77d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	23.37.170.12 23.37.170.12	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.108.248.7 13.108.248.7	14340 (SALESFORCE) (SALESFORCE)
6	104.17.74.206 104.17.74.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:801::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:252f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:eb:... 2a02:26f0:eb:3b4::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 5	2a00:1450:400... 2a00:1450:4001:81d::200e	15169 (GOOGLE) (GOOGLE)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1	172.217.23.130 172.217.23.130	15169 (GOOGLE) (GOOGLE)
1 2	216.58.206.6 216.58.206.6	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	88.221.60.75 88.221.60.75	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.224.198.74 13.224.198.74	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3036::681b:9d96	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	37.252.172.36 37.252.172.36	29990 (ASN-APPNEX) (ASN-APPNEX)
1	13.226.154.83 13.226.154.83	16509 (AMAZON-02) (AMAZON-02)
2	13.226.154.118 13.226.154.118	16509 (AMAZON-02) (AMAZON-02)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:825::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
3	3.232.27.189 3.232.27.189	14618 (AMAZON-AES) (AMAZON-AES)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:816::200a	15169 (GOOGLE) (GOOGLE)
1	34.227.185.217 34.227.185.217	14618 (AMAZON-AES) (AMAZON-AES)
1	2a03:2880:f01... 2a03:2880:f01c:8004:face:b00c:0:8c	32934 (FACEBOOK) (FACEBOOK)
1	2600:9000:218... 2600:9000:2182:9400:1a:2af:6d00:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	34.251.7.133 34.251.7.133	16509 (AMAZON-02) (AMAZON-02)
3	23.10.73.123 23.10.73.123	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.200.197.210 34.200.197.210	14618 (AMAZON-AES) (AMAZON-AES)
1	23.210.250.213 23.210.250.213	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	13.108.250.135 13.108.250.135	14340 (SALESFORCE) (SALESFORCE)
1	183.79.249.124 183.79.249.124	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
1	192.28.147.68 192.28.147.68	53580 (MARKETO) (MARKETO)
1	52.57.146.39 52.57.146.39	16509 (AMAZON-02) (AMAZON-02)
1	13.110.66.53 13.110.66.53	14340 (SALESFORCE) (SALESFORCE)
1	183.79.255.28 183.79.255.28	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
2	2a00:1288:f03... 2a00:1288:f03d:1fa::4000	10310 (YAHOO-1) (YAHOO-1)
1	54.76.90.77 54.76.90.77	16509 (AMAZON-02) (AMAZON-02)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
92	45

23 2606:4700:300b::a29f:f77d (United States)

ASN13335 (CLOUDFLARENET, US)

www.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.37.170.12 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-170-12.deploy.static.akamaitechnologies.com

cloud.typography.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.108.248.7 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl1-ord.la1-c2-ord.salesforceliveagent.com

c.la2c2.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.17.74.206 (United States)

ASN13335 (CLOUDFLARENET, US)

www2.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:252f (United States)

ASN13335 (CLOUDFLARENET, US)

js.maxmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:eb:3b4::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81d::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s18-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.6 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s20-in-f6.1e100.net

8443343.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.221.60.75 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.198.74 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-198-74.fra2.r.cloudfront.net

app.cdn.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::681b:9d96 (United States)

ASN13335 (CLOUDFLARENET, US)

v2.listenloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.172.36 (Ascension Island) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.154.83 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-154-83.dus51.r.cloudfront.net

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.226.154.118 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-154-118.dus51.r.cloudfront.net

lftracker.leadfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9b (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland) 1 redirects

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.232.27.189 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-27-189.compute-1.amazonaws.com

abm2.listenloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.227.185.217 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-227-185-217.compute-1.amazonaws.com

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:8004:face:b00c:0:8c (Ireland)

ASN32934 (FACEBOOK, US)

cx.atdmt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:9400:1a:2af:6d00:93a1 (United States)

ASN16509 (AMAZON-02, US)

tr.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.251.7.133 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-7-133.eu-west-1.compute.amazonaws.com

segment.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.10.73.123 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-10-73-123.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.200.197.210 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-197-210.compute-1.amazonaws.com

jukebox.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.250.213 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-213.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.108.250.135 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl6-ord.la1-c2-ord.salesforceliveagent.com

d.la2c2.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 183.79.249.124 (Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN53580 (MARKETO, US)

848-did-242.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.57.146.39 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-146-39.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.110.66.53 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl3-ncg1-c6-iad5.la1-c1-ia5.salesforceliveagent.com

d.la1-c1-ia5.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 183.79.255.28 (Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

b91.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:f03d:1fa::4000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.90.77 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-90-77.eu-west-1.compute.amazonaws.com

fireeye.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Switzerland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	fireeye.com www.fireeye.com www2.fireeye.com	1 MB
5	google-analytics.com 1 redirects www.google-analytics.com	19 KB
4	listenloop.com v2.listenloop.com abm2.listenloop.com	60 KB
4	doubleclick.net 2 redirects 8443343.fls.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	4 KB
4	addthis.com s7.addthis.com m.addthis.com	190 KB
3	6sc.co j.6sc.co c.6sc.co b.6sc.co	8 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	lookbookhq.com app.cdn.lookbookhq.com jukebox.lookbookhq.com	237 KB
3	salesforceliveagent.com c.la2c2.salesforceliveagent.com d.la2c2.salesforceliveagent.com d.la1-c1-ia5.salesforceliveagent.com	42 KB
2	yimg.com s.yimg.com	6 KB
2	bidr.io 1 redirects segment.prod.bidr.io	1 KB
2	pathfactory.com cdn.pathfactory.com jukebox.pathfactory.com	32 KB
2	facebook.com 1 redirects www.facebook.com	678 B
2	google.de www.google.de	707 B
2	google.com 1 redirects www.google.com	501 B
2	adnxs.com 2 redirects secure.adnxs.com	2 KB
2	marketo.net munchkin.marketo.net	6 KB
2	facebook.net connect.facebook.net	162 KB
2	bing.com bat.bing.com	8 KB
2	maxmind.com js.maxmind.com	2 KB
1	yahoo.com sp.analytics.yahoo.com	528 B
1	omtrdc.net fireeye.tt.omtrdc.net	1004 B
1	yahoo.co.jp b91.yahoo.co.jp	909 B
1	6sense.com epsilon.6sense.com	593 B
1	mktoresp.com 848-did-242.mktoresp.com	304 B
1	yimg.jp s.yimg.jp	2 KB
1	addthisedge.com v1.addthisedge.com	958 B
1	twitter.com analytics.twitter.com	651 B
1	moatads.com z.moatads.com	1 KB
1	lfeeder.com tr.lfeeder.com	291 B
1	atdmt.com cx.atdmt.com	448 B
1	googleapis.com fonts.googleapis.com	1 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	7 KB
1	t.co t.co	449 B
1	leadfeeder.com lftracker.leadfeeder.com	4 KB
1	ml-api.io attr.ml-api.io	485 B
1	ml-attr.com 1 redirects s.ml-attr.com	277 B
1	googleadservices.com www.googleadservices.com	12 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	licdn.com snap.licdn.com	2 KB
1	googletagmanager.com www.googletagmanager.com	86 KB
1	typography.com 1 redirects cloud.typography.com	456 B
92	42

	Domain	Requested by
23	www.fireeye.com	www.fireeye.com app.cdn.lookbookhq.com
6	www2.fireeye.com	www.fireeye.com www2.fireeye.com
5	www.google-analytics.com	1 redirects www.googletagmanager.com www.fireeye.com
3	abm2.listenloop.com	www.fireeye.com
3	s7.addthis.com	www.fireeye.com s7.addthis.com
2	s.yimg.com	www.fireeye.com
2	jukebox.lookbookhq.com	www.fireeye.com
2	segment.prod.bidr.io	1 redirects www.fireeye.com
2	www.facebook.com	1 redirects www.fireeye.com
2	www.google.de	www.fireeye.com
2	www.google.com	1 redirects www.fireeye.com
2	px.ads.linkedin.com	1 redirects www.fireeye.com
2	secure.adnxs.com	2 redirects
2	munchkin.marketo.net	www.googletagmanager.com munchkin.marketo.net
2	connect.facebook.net	www.fireeye.com connect.facebook.net
2	8443343.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	bat.bing.com	www.googletagmanager.com www.fireeye.com
2	js.maxmind.com	www.fireeye.com
1	sp.analytics.yahoo.com	www.fireeye.com
1	fireeye.tt.omtrdc.net	www.fireeye.com
1	b91.yahoo.co.jp	www.fireeye.com
1	d.la1-c1-ia5.salesforceliveagent.com	www.fireeye.com
1	epsilon.6sense.com	www.fireeye.com
1	848-did-242.mktoresp.com	www.fireeye.com
1	b.6sc.co	www.fireeye.com
1	c.6sc.co	www.fireeye.com
1	s.yimg.jp	www.googletagmanager.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	d.la2c2.salesforceliveagent.com	www.fireeye.com
1	analytics.twitter.com	www.fireeye.com
1	z.moatads.com	s7.addthis.com
1	j.6sc.co	www.fireeye.com
1	tr.lfeeder.com	www.fireeye.com
1	cx.atdmt.com	www.fireeye.com
1	jukebox.pathfactory.com	www.fireeye.com
1	cdn.pathfactory.com	www.fireeye.com
1	fonts.googleapis.com	www.fireeye.com
1	maxcdn.bootstrapcdn.com	www.fireeye.com
1	googleads.g.doubleclick.net	www.fireeye.com
1	t.co	www.fireeye.com
1	stats.g.doubleclick.net	1 redirects
1	www.linkedin.com	1 redirects
1	lftracker.leadfeeder.com	www.fireeye.com
1	attr.ml-api.io	www.fireeye.com
1	s.ml-attr.com	1 redirects
1	v2.listenloop.com	www.fireeye.com
1	app.cdn.lookbookhq.com	www.fireeye.com
1	www.googleadservices.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.googletagmanager.com	www.fireeye.com
1	c.la2c2.salesforceliveagent.com	www.fireeye.com
1	cloud.typography.com	1 redirects
92	54

This site contains links to these domains. Also see Links.

Domain
fireeyecommunity.force.com
docs.fireeye.com
partners.fireeye.com
training.fireeye.com
www2.fireeye.com
vision.fireeye.com
fireeye.market
investors.fireeye.com
attack.mitre.org
intelligence.fireeye.com
www.bleepingcomputer.com
csportal.fireeye.com
community.fireeye.com
www.linkedin.com
twitter.com
www.facebook.com
www.youtube.com
itunes.apple.com
www.fireeye.fr
www.fireeye.de
www.fireeye.jp
www.fireeye.kr
www.addthis.com

Subject Issuer	Validity	Valid
fireeye.com CloudFlare Inc ECC CA-2	`2019-12-11` - `2020-10-09`	10 months	crt.sh
la1-c2-ord.salesforceliveagent.com DigiCert SHA2 Secure Server CA	`2018-07-31` - `2020-07-30`	2 years	crt.sh
www2.fireeye.com CloudFlare Inc ECC CA-2	`2020-03-06` - `2020-10-09`	7 months	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-06-15` - `2020-09-04`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
*.maxmind.com COMODO RSA Organization Validation Secure Server CA	`2018-10-15` - `2020-11-06`	2 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-05-14` - `2020-08-05`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
cdn.lookbookhq.com Amazon	`2019-12-06` - `2021-01-06`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-04` - `2020-10-09`	8 months	crt.sh
*.ml-api.io Amazon	`2020-02-06` - `2021-03-06`	a year	crt.sh
*.leadfeeder.com Amazon	`2020-03-13` - `2021-04-13`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-03-04` - `2020-09-04`	6 months	crt.sh
www.google.de GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
*.listenloop.com RapidSSL RSA CA 2018	`2019-06-14` - `2021-06-17`	2 years	crt.sh
www.google.com GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
*.pathfactory.com Amazon	`2020-04-05` - `2021-05-05`	a year	crt.sh
*.atlassolutions.com DigiCert SHA2 High Assurance Server CA	`2020-04-19` - `2020-07-18`	3 months	crt.sh
*.lfeeder.com Amazon	`2019-10-02` - `2020-11-02`	a year	crt.sh
*.segment.prod.bidr.io Amazon	`2020-03-26` - `2021-04-26`	a year	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2020-01-07` - `2021-04-07`	a year	crt.sh
*.lookbookhq.com Amazon	`2020-04-28` - `2021-05-28`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.yahoo.co.jp Cybertrust Japan Public CA G3	`2019-09-24` - `2020-10-23`	a year	crt.sh
*.mktoresp.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2022-01-21`	2 years	crt.sh
*.6sense.com Amazon	`2019-08-16` - `2020-09-16`	a year	crt.sh
la1-c1-ia5.salesforceliveagent.com DigiCert SHA2 Secure Server CA	`2019-05-14` - `2021-05-13`	2 years	crt.sh
rd.listing.yahoo.co.jp Cybertrust Japan Public CA G3	`2019-08-30` - `2020-09-29`	a year	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-05-19` - `2020-07-03`	a month	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-03-04` - `2020-08-31`	6 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Frame ID: 4C678F7F44352DDCBB19D46E6E259B18
Requests: 95 HTTP requests in this frame

Frame: https://8443343.fls.doubleclick.net/activityi;dc_pre=CMTtleyyjeoCFQ6Dgwcds8sPBw;src=8443343;type=sitew0;cat=firee0;ord=5133487605240;gtm=2wg6a0;auiddc=29066816.1592553162;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html;u2=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html
Frame ID: CB6944D412C3F44D5ED5FFEB4540F94F
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 98F8B5CDB315E4288437D2C5CB156F21
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 51B5ADB252DDA9EDDB1316681098085A
Requests: 1 HTTP requests in this frame

Frame: https://www2.fireeye.com/index.php/form/XDFrame
Frame ID: A7158F4A88325A6550B39E0B26050B14
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i
script /\/etc.clientlibs\//i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i
script /\/etc.clientlibs\//i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

92
Requests

98 %
HTTPS

41 %
IPv6

42
Domains

54
Subdomains

45
IPs

9
Countries

2351 kB
Transfer

5457 kB
Size

32
Cookies

26 Outgoing links

These are links going to different origins than the main page.

URL: https://fireeyecommunity.force.com/CustomerCommunity/s/
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://fireeyecommunity.force.com/CustomerCommunity/s/support-community
Title: Communities

Search URL Search Domain Scan URL

URL: https://docs.fireeye.com/
Title: Documentation Portal

Search URL Search Domain Scan URL

URL: https://partners.fireeye.com/directory/
Title: Partner Locator

Search URL Search Domain Scan URL

URL: http://training.fireeye.com/
Title: Partner Education Center

Search URL Search Domain Scan URL

URL: https://www2.fireeye.com/Partner-Request-LP-New.html
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://partners.fireeye.com/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://vision.fireeye.com/
Title: The Vision – Digital Magazine

Search URL Search Domain Scan URL

URL: https://fireeye.market/
Title: FireEye Market

Search URL Search Domain Scan URL

URL: http://investors.fireeye.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1100
Title: MITRE ATT&CK Technique 1100

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1108
Title: Redundant Access

Search URL Search Domain Scan URL

URL: https://intelligence.fireeye.com/reports/16-00006120
Title: hidden in images

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/hackers-hiding-web-shell-logins-in-fake-http-error-pages/
Title: hidden in 404 error pages

Search URL Search Domain Scan URL

URL: https://csportal.fireeye.com/secur/login_portal.jsp?orgId=00D3000000063LS&portalId=06030000000pSNE
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://community.fireeye.com/welcome
Title: Communities

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fireeye
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/fireeye
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/FireEye
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/FireEyeInc
Title: YouTube

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/podcast/eye-on-security/id1073779629?mt=2
Title: Podcast

Search URL Search Domain Scan URL

URL: https://www.fireeye.fr/
Title: French (Français)

Search URL Search Domain Scan URL

URL: https://www.fireeye.de/
Title: German (Deutsch)

Search URL Search Domain Scan URL

URL: https://www.fireeye.jp/
Title: Japanese (日本語)

Search URL Search Domain Scan URL

URL: https://www.fireeye.kr/
Title: Korean (한국어)

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://cloud.typography.com/6746836/6977592/css/fonts.css HTTP 302
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

Request Chain 28

https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=5133487605240;gtm=2wg6a0;auiddc=29066816.1592553162;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html;u2=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html HTTP 302
https://8443343.fls.doubleclick.net/activityi;dc_pre=CMTtleyyjeoCFQ6Dgwcds8sPBw;src=8443343;type=sitew0;cat=firee0;ord=5133487605240;gtm=2wg6a0;auiddc=29066816.1592553162;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html;u2=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html

Request Chain 33

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=fireeye.com&pId=198631653850497077

Request Chain 35

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&time=1592553162078 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fproducts-and-services%252F2019%252F08%252Ffireeye-adds-web-shell-detection-to-protect-servers.html%26time%3D1592553162078%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&time=1592553162078&liSync=true

Request Chain 36

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1183127167&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&ul=en-us&de=UTF-8&dt=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=848383080&gjid=492642770&cid=1278446573.1592553162&tid=UA-363943-1&_gid=1253527829.1592553162&_r=1&gtm=2wg6a0MVGC8KK&cd39=1278446573.1592553162&z=1778727839 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=1278446573.1592553162&jid=848383080&_gid=1253527829.1592553162&gjid=492642770&_v=j83&z=1778727839 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1278446573.1592553162&jid=848383080&_v=j83&z=1778727839 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1278446573.1592553162&jid=848383080&_v=j83&z=1778727839&slf_rd=1&random=948751398

Request Chain 51

https://www.facebook.com/tr/?id=1847206522249226&ev=Microdata&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&rl=&if=false&ts=1592553162717&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc%22%2C%22meta%3Adescription%22%3A%22FireEye%20web%20shell%20detection%20is%20available%20in%20the%208.3.0%20release%20of%20FireEye%20Network%20Security.%5Cn%22%7D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%22%2C%22og%3Atype%22%3A%22website%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png%22%2C%22og%3Adescription%22%3A%22FireEye%20web%20shell%20detection%20is%20available%20in%20the%208.3.0%20release%20of%20FireEye%20Network%20Security.%5Cn%22%2C%22og%3Asite_name%22%3A%22FireEye%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.18&r=stable&ec=1&o=30&fbp=fb.1.1592553162213.754618275&it=1592553162105&coo=false&es=automatic&tm=3&rqm=GET HTTP 302
https://cx.atdmt.com/?c=6145699801493334693&f=AYx3GuVa2QIiznM5JMN_C1AjxFp_F2zfcvIe9A2o6d9eRJGsmIizWJ9zRFjm9Ft_Qh2MNWCGhW_onPamN6Is5sxp&id=1847206522249226&l=3&v=0

Request Chain 53

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value= HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

92 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request fireeye-adds-web-shell-detection-to-protect-servers.html Show response
www.fireeye.com/blog/products-and-services/2019/08/ 74 KB
20 KB 883ms
859ms Document
text/html 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c36dd933050a2d18930871de47783867670d54c5adb9241d4f5ea802b246cc3a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.fireeye.com
:scheme: https
:path: /blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 19 Jun 2020 07:52:41 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=de6fb53b5481981e416d7125ae35f55151592553160; expires=Sun, 19-Jul-20 07:52:40 GMT; path=/; domain=.fireeye.com; HttpOnly; SameSite=Lax; Secure
cf-ray: 5a5bac048cd73244-FRA
cache-control: no-cache="set-cookie"
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,User-Agent
cf-cache-status: MISS
cf-request-id: 036d29d6d300003244e68a0200000001
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-content-type-options: nosniff nosniff
x-dispatcher: dispatcher1uswest1
x-frame-options: ALLOW-FROM https://content.fireeye.com
x-vhost: publish
x-xss-protection: 1; mode=block
server: cloudflare
content-encoding: gzip

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 111 KB
38 KB 29ms
26ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 393
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 38305
cf-request-id: 036d29da3700003244e68ea200000001
last-modified: Fri, 26 Jul 2019 09:54:26 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1baa2-58e9287119880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff833244-FRA

GET
H2 200 csrf.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/ 4 KB
2 KB 695ms
692ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1676
cf-request-id: 036d29da3800003244e68ee200000001
last-modified: Fri, 26 Jul 2019 09:54:26 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "f3e-58e9287119880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff8b3244-FRA

GET
H2 200 clientlibs_nav.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 12 KB
4 KB 31ms
28ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_nav.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 393
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 3882
cf-request-id: 036d29da3800003244e68ef200000001
last-modified: Fri, 24 Apr 2020 04:08:24 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "2f77-5a401843bfe00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff8c3244-FRA

GET
H2

200

3982EDB9831683D51.css
www.fireeye.com/content/dam/fireeye-www/fw/f/775489/
Redirect Chain

https://cloud.typography.com/6746836/6977592/css/fonts.css
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

293 KB
219 KB

26ms
26ms

Stylesheet
text/css

2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 12930
cf-polished: origSize=301416
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
cf-request-id: 036d29e0e500003244e6974200000001
last-modified: Wed, 01 Apr 2020 20:06:18 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: W/"49968-5a240379a0280-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5a5bac14adc13244-FRA
cf-bgj: minify

Redirect headers

Date: Fri, 19 Jun 2020 07:52:42 GMT
Last-Modified: Wed, 01 Apr 2020 20:12:09 GMT
Server: AkamaiNetStorage
ETag: "d0795af83d79e23ccaffb60b4a75e364:1585771928"
Content-Type: text/html
Location: https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css
Cache-Control: must-revalidate, private
Connection: keep-alive
X-HCo-pid: 14
Content-Length: 154
Expires: Fri, 19 June 2020 07:52:42 GMT

GET
H2 200 patch.css
www.fireeye.com/content/dam/fireeye-www/fw/css/ 360 B
379 B 32ms
29ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/css/patch.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a681cca9fc0504acacb6157248b780c9cbaff015575f4d30f5ab0756329ebeb

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 662
cf-polished: origSize=559
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
cf-request-id: 036d29da3800003244e68eb200000001
last-modified: Fri, 05 Jul 2019 19:55:15 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: W/"22f-58cf47916cec0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5a5bac09ff863244-FRA
cf-bgj: minify

GET
H2 200 clientlibs_fw-2019.min.css
www.fireeye.com/etc/designs/fireeye-www/ 210 KB
40 KB 25ms
22ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d20cf953b941d38ca8b450334f135fbe787dc4cb8371f4032fda9337cbfd5836

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 2940
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 41247
cf-request-id: 036d29da3800003244e68ec200000001
last-modified: Fri, 29 May 2020 04:36:44 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "3467b-5a6c1fe020f00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff873244-FRA

GET
H2 200 clientlibs_base.min.css
www.fireeye.com/etc/clientlibs/fireeye-blog/ 5 KB
2 KB 63ms
61ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientlibs/fireeye-blog/clientlibs_base.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 38775
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1501
cf-request-id: 036d29da3800003244e68ed200000001
last-modified: Fri, 04 Oct 2019 04:55:04 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1507-5940e81577a00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff893244-FRA

GET
H2 200 utils.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 10 KB
4 KB 666ms
664ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/utils.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 3706
cf-request-id: 036d29da3800003244e68f0200000001
last-modified: Fri, 26 Jul 2019 09:42:21 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "26ad-58e925bdaf940-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff8f3244-FRA

GET
H2 200 granite.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/ 4 KB
2 KB 657ms
655ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1702
cf-request-id: 036d29da3800003244e68f1200000001
last-modified: Fri, 26 Jul 2019 09:54:26 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "f90-58e9287119880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff903244-FRA

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 16 B
173 B 31ms
29ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 339
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 16
cf-request-id: 036d29da3800003244e68f2200000001
last-modified: Fri, 26 Jul 2019 09:42:45 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "10-58e925d492f40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff923244-FRA

GET
H2 200 shared.min.js Show response
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 24 KB
7 KB 659ms
658ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/shared.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 6920
cf-request-id: 036d29da3800003244e68f3200000001
last-modified: Fri, 26 Jul 2019 09:42:45 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "5e7e-58e925d492f40-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff933244-FRA

GET
H2 200 modern.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/ 34 KB
12 KB 671ms
669ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/modern.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 11784
cf-request-id: 036d29da3800003244e68f4200000001
last-modified: Tue, 17 Oct 2017 06:49:31 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "87c8-55bb8866db4c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff963244-FRA

GET
H2 200 kernel.min.js Show response
www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/ 119 KB
26 KB 63ms
62ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/kernel.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 339
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 26194
cf-request-id: 036d29da3800003244e68f5200000001
last-modified: Fri, 26 Jul 2019 09:42:47 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1dd96-58e925d67b3c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac09ff973244-FRA

GET
H/1.1 200
OK deployment.js Show response
c.la2c2.salesforceliveagent.com/content/g/js/34.0/ 40 KB
41 KB 964ms
157ms Script
application/javascript 13.108.248.7
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.la2c2.salesforceliveagent.com/content/g/js/34.0/deployment.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.108.248.7 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS: dcl1-ord.la1-c2-ord.salesforceliveagent.com
Software: Jetty(9.4.z-SNAPSHOT) /
Resource Hash: 3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 19 Jun 2020 07:52:42 GMT
Cache-Control: max-age=60, must-revalidate
Last-Modified: Fri, 15 May 2020 16:22:02 GMT
Server: Jetty(9.4.z-SNAPSHOT)
Accept-Ranges: bytes
Content-Length: 41338
Content-Type: application/javascript

GET
H2 200 fireeye-2-color.png
www.fireeye.com/content/dam/fireeye-www/fw/images/ 2 KB
2 KB 44ms
43ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/images/fireeye-2-color.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48dca69d4a48f11abaa7e1a0d846cb4484c0c4fe7ca90552fa7483b1e53ab74b

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 394
cf-polished: origSize=3668
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 2250
cf-request-id: 036d29dcf200003244e6924200000001
last-modified: Mon, 25 Feb 2019 20:12:45 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "e54-582bd904dc940"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac0e59d13244-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Picture3.png
www.fireeye.com/content/dam/fireeye-www/blog/images/webshelldetection/ 183 KB
183 KB 994ms
993ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/webshelldetection/Picture3.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b205100033a7fe4eff3d80cad57e9d50bccb731475d0f457130dd8788237ba0b

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:42 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 186934
cf-request-id: 036d29dcf200003244e6925200000001
last-modified: Tue, 20 Aug 2019 09:38:22 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "2da36-5908937a47f80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac0e59d33244-FRA

GET
H2 200 blog-vision-edition7.gif
www.fireeye.com/content/dam/fireeye-www/blog/images/ 570 KB
571 KB 37ms
37ms Image
image/gif 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/blog-vision-edition7.gif

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5062a8070951a1c77103a1bb6d96a11f185c50e4ee7b317320a8588243f6d828

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Fri, 19 Jun 2020 07:52:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 512
cf-polished: origSize=592867
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 584046
cf-request-id: 036d29dcf200003244e6926200000001
last-modified: Thu, 04 Jun 2020 22:12:02 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "90be3-5a7496f1a5080"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac0e59d43244-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ 203 KB
68 KB 294ms
50ms Script
application/x-javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30b92b1d67692c95ef6d322b21cb9e0c2f7d5a4c68c05b4e3e3e87489ec41309

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6821
status: 200
vary: Accept-Encoding
cf-request-id: 036d29ddf60001006b211dd200000001
last-modified: Sat, 06 Jun 2020 07:41:36 GMT
server: cloudflare
etag: "4617e8-32dcc-5a76581e289b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 5a5bac0ff8210000-ARN
expires: Fri, 19 Jun 2020 11:52:42 GMT

GET
H2 200 clientlibs_fw.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 164 KB
49 KB 20ms
19ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24b7b2f7b99ef95b2f4fbd89f372e734216c11d8467af0e795f354937b461e21

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 393
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 50472
cf-request-id: 036d29dcf200003244e6923200000001
last-modified: Fri, 29 May 2020 04:55:23 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "28e57-5a6c240b4a4c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac0e59cd3244-FRA

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 195ms
63ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

079c30478215da1e544443314dabb6ab1251fa2ae56447ace992ade3bbe3fd0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Tue, 02 Jun 2020 20:09:59 GMT
server: nginx/1.15.8
etag: "5ed6b217-582c2"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Fri, 19 Jun 2020 07:52:42 GMT
x-host: s7.addthis.com
content-length: 116254

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 280 KB
86 KB 52ms
31ms Script
application/javascript 2a00:1450:4001:801::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9b12e00d0e865f5138dc28999b4647c511f3aa135354dfb518f30e208682a622

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87282
x-xss-protection: 0
last-modified: Fri, 19 Jun 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 19 Jun 2020 07:52:42 GMT

GET
H2 200 token.json Show response
www.fireeye.com/libs/granite/csrf/ 2 B
843 B 664ms
664ms XHR
application/json 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/libs/granite/csrf/token.json

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Fri, 19 Jun 2020 07:52:42 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 2
cf-request-id: 036d29dcef00003244e6922200000001
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json;charset=iso-8859-1
x-xss-protection: 1; mode=block
cache-control: no-cache, no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5a5bac0e49bd3244-FRA
expires: -1

GET
H2 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 771 B
1 KB 87ms
68ms XHR
application/vnd.maxmind.com-country+json 2606:4700::6810:252f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:252f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 353061679934adbd94e40e884dd4f85a7d74da808db2bf28e38d23db407a5e2e

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 5a5bac0e68c1177e-FRA
content-length: 771
cf-request-id: 036d29dd040000177e6d9ad200000001

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 23ms
9ms Script
application/x-javascript 2a02:26f0:eb:3b4::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:eb:3b4::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 19 Jun 2020 07:52:42 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=70153
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 bat.js Show response
bat.bing.com/ 25 KB
8 KB 47ms
29ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: b6f7b31210a709daca9760b215660b2cbe719757df3059364beeda005fca2dbe

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:41 GMT
content-encoding: gzip
last-modified: Wed, 10 Jun 2020 19:59:59 GMT
x-msedge-ref: Ref A: E933E0A2D74D4256B69DEC1BA4EB4295 Ref B: FRAEDGE1321 Ref C: 2020-06-19T07:52:42Z
status: 200
etag: "804946b8613fd61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7799

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 Jun 2020 23:38:14 GMT
server: Golfe2
age: 3383
date: Fri, 19 Jun 2020 06:56:19 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18469
expires: Fri, 19 Jun 2020 08:56:19 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 178ms
60ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT
content-encoding: gzip
age: 28155
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19122-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1592553162.206035,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
12 KB 208ms
66ms Script
text/javascript 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

a693efa7265b630e27e537f6ba09c5558a23b9ed2f57abdbf417c237a50a5156

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-28="googleads.g.doubleclick.net:443"; ma=2592000,h3-28=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11020
x-xss-protection: 0
server: cafe
etag: 13497728949557021888
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 19 Jun 2020 07:52:42 GMT

GET
H2

200

activityi;dc_pre=CMTtleyyjeoCFQ6Dgwcds8sPBw;src=8443343;type=sitew0;cat=firee0;ord=5133487605240;gtm=2wg6a0;auiddc=29066816.1592553162;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-service...
8443343.fls.doubleclick.net/ Frame CB69
Redirect Chain

https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=5133487605240;gtm=2wg6a0;auiddc=29066816.1592553162;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-servi...
https://8443343.fls.doubleclick.net/activityi;dc_pre=CMTtleyyjeoCFQ6Dgwcds8sPBw;src=8443343;type=sitew0;cat=firee0;ord=5133487605240;gtm=2wg6a0;auiddc=29066816.1592553162;u1=https%3A%2F%2Fwww.firee...

0
0

69ms
69ms

Document
text/html

216.58.206.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8443343.fls.doubleclick.net/activityi;dc_pre=CMTtleyyjeoCFQ6Dgwcds8sPBw;src=8443343;type=sitew0;cat=firee0;ord=5133487605240;gtm=2wg6a0;auiddc=29066816.1592553162;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html;u2=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.6 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8443343.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CMTtleyyjeoCFQ6Dgwcds8sPBw;src=8443343;type=sitew0;cat=firee0;ord=5133487605240;gtm=2wg6a0;auiddc=29066816.1592553162;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html;u2=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Fri, 19 Jun 2020 07:52:42 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 486
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Fri, 19-Jun-2020 08:07:42 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Fri, 19 Jun 2020 07:52:42 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://8443343.fls.doubleclick.net/activityi;dc_pre=CMTtleyyjeoCFQ6Dgwcds8sPBw;src=8443343;type=sitew0;cat=firee0;ord=5133487605240;gtm=2wg6a0;auiddc=29066816.1592553162;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html;u2=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 131 KB
32 KB 18ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4cb61e44bf63a9e090e666898cd04d382e4c33b55b62cc5e9ff7dab055fbf787

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 31766
x-xss-protection: 0
pragma: public
x-fb-debug: cDEn8b1AKXBGd61M1TOOt9HrzOX0cGpTZ1QFzR18e+1g4HoxW3Dxv7BTK8ANi2lnBAXi/j8o9ldr0D2qvqTkVA==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Fri, 19 Jun 2020 07:52:42 GMT, Fri, 19 Jun 2020 07:52:42 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 209ms
69ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.60.75 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c7d7214a0b940c1ffcbd64689a576c5847b42e886da3ad9ea45bc4cda214bac8

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 19 Jun 2020 07:52:42 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Apr 2020 02:45:45 GMT
Server: Apache
ETag: "aa520b8aca3502dbdbf62462e6f4be67:1585881945"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 751

GET
H2 200 jukebox.js Show response
app.cdn.lookbookhq.com/production/jukebox/current/ 946 KB
236 KB 254ms
93ms Script
text/javascript 13.224.198.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.198.74 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-198-74.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5c5fa3187f5382e332df049161fd649a883eaa14577050ae26204d5f5b66c197

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Wed, 10 Jun 2020 01:01:40 GMT
server: AmazonS3
age: 26308
date: Fri, 19 Jun 2020 01:06:10 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
status: 200
cache-control: max-age=43200
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: xdkfhDRSGIVjc57_Gmo1F7OM3YNAmBHr1mJ3M-t-VHKPNswjNo-xCw==
via: 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)

GET
H2 200 loop.bundle.js Show response
v2.listenloop.com/ 175 KB
57 KB 72ms
26ms Script
application/javascript 2606:4700:3036::681b:9d96
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v2.listenloop.com/loop.bundle.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681b:9d96 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c91c97d78511fa85c181fd5f00e2b396893423a8389dc61703502dc1f772fa02

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 5815
status: 200
x-amz-request-id: 467186FFFEDA1992
x-amz-id-2: rHs6Tb2NvEcLc/+/NFyq7X+/z6ZNsyr4JG34Aqz+00WflsY5vVEb3WmYdY9sQEclSd6qfvLWhx4=
last-modified: Tue, 16 Jun 2020 11:14:16 GMT
server: cloudflare
etag: W/"6dd35a1b93b9262da909ba97e485e65a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-request-id: 036d29dd8c0000bf19330e3200000001
cf-ray: 5a5bac0f49fabf19-FRA

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=fireeye.com&pId=198631653850497077

4 B
485 B

1284ms
569ms

Image
image/jpeg

13.226.154.83
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=fireeye.com&pId=198631653850497077
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.154.83 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-154-83.dus51.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 19 Jun 2020 07:52:43 GMT
Via: 1.1 a608f2055229f2ea193f6b8f15267a71.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUS51-C1
x-amzn-RequestId: e9030630-9250-4621-ad58-82bb05d5160d
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-5eec6ecb-7eda73004d8e6fc971eac98d;Sampled=0
Connection: keep-alive
x-amz-apigw-id: OXY_2GijIAMFTZQ=
Content-Length: 4
X-Amz-Cf-Id: tIV71WH2pSuO9tDgtSr_eajxE2UMOT8W1ehYV-yX7Dc3KkMYKcOumw==

Redirect headers

Pragma: no-cache
Date: Fri, 19 Jun 2020 07:52:44 GMT
X-Proxy-Origin: 165.231.142.36; 165.231.142.36; 692.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.44:80
AN-X-Request-Uuid: 88ed2397-682c-49db-b017-07ea7913cf11
Server: nginx/1.13.4
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=fireeye.com&pId=198631653850497077
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 lftracker_v1_3P1w24dgrmJ7mY5n.js Show response
lftracker.leadfeeder.com/ 9 KB
4 KB 684ms
228ms Script
application/javascript 13.226.154.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lftracker.leadfeeder.com/lftracker_v1_3P1w24dgrmJ7mY5n.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.154.118 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-154-118.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b237272f023f577721bdec0286b15f67e93c705be01c08bf037ae7d4738dcbb7

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:00:27 GMT
content-encoding: gzip
last-modified: Wed, 17 Jun 2020 11:52:57 GMT
server: AmazonS3
age: 3136
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: YLbwk3NmsaaVlHipxBuhHYHCjhxPgUYVmVP2-yNHOHjwqiOFU5aGOA==
via: 1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&time=...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fproducts-and-servic...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&time=...

0
57 B

122ms
121ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&time=1592553162078&liSync=true
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: A/mY26niGRbgkoEqdisAAA==

Redirect headers

strict-transport-security: max-age=2592000
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: bprY16niGRZQw/tnDisAAA==
pragma: no-cache
x-li-pop: afd-prod-edc2
x-msedge-ref: Ref A: A06AC12859E24B95917799EB99E2E479 Ref B: FRAEDGE1319 Ref C: 2020-06-19T07:52:42Z
date: Fri, 19 Jun 2020 07:52:41 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&time=1592553162078&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1183127167&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=1278446573.1592553162&jid=848383080&_gid=1253527829.1592553162&gjid=492642770&_v=j83&z=1778727839
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1278446573.1592553162&jid=848383080&_v=j83&z=1778727839
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1278446573.1592553162&jid=848383080&_v=j83&z=1778727839&slf_rd=1&random=948751398

42 B
554 B

36ms
17ms

Image
image/gif

2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1278446573.1592553162&jid=848383080&_v=j83&z=1778727839&slf_rd=1&random=948751398

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 19 Jun 2020 07:52:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 19 Jun 2020 07:52:42 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1278446573.1592553162&jid=848383080&_v=j83&z=1778727839&slf_rd=1&random=948751398
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1847206522249226 Show response
connect.facebook.net/signals/config/ 517 KB
130 KB 70ms
70ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1847206522249226?v=2.9.18&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d4eae71ff47319b9bcb824e70dbfbe6da1be9fa875552c57e5fe557587010406

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: MI/RM8/7GEQLW8IO2jtOBy5QFUQ1yRZMN4r+DYULmCyTuykZi04jVF3ptqWdvhANnt20qerKhxIv1jJJ3ENATg==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Fri, 19 Jun 2020 07:52:42 GMT, Fri, 19 Jun 2020 07:52:42 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
148 B 31ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5870833&Ver=2&mid=8ac67fd3-9bdc-2077-50da-12be9265abbc&sid=85ff0868-5d85-bc30-470e-21336e7e1c65&vid=859ac6c3-1180-2cb7-4bae-ace7138024e5-1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&p=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&r=&evt=pageLoad&msclkid=N&sv=1&rn=601851
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Fri, 19 Jun 2020 07:52:41 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 24D63CE561B2429D8C4CB13771C68AD5 Ref B: FRAEDGE1321 Ref C: 2020-06-19T07:52:42Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
361 B 19ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1847206522249226&ev=PageView&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&rl=&if=false&ts=1592553162214&sw=1600&sh=1200&v=2.9.18&r=stable&ec=0&o=30&fbp=fb.1.1592553162213.754618275&it=1592553162105&coo=false&rqm=GET

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT, Fri, 19 Jun 2020 07:52:42 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 19 Jun 2020 07:52:42 GMT

GET
H2 200 adsct
t.co/i/ 43 B
449 B 275ms
165ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Fri, 19 Jun 2020 07:52:42 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: d1458e984124b59cad0a8b82b5477160
x-transaction: 0056f7e800d88643
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/ 2 KB
2 KB 37ms
17ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/?random=1592553162273&cv=9&fst=1592553162273&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6a0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&tiba=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25985aa3209936e917d938425dae95783d44571ec6016c8b25cacab21e90af70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 19 Jun 2020 07:52:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-28="googleads.g.doubleclick.net:443"; ma=2592000,h3-28=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1080
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK me Show response
abm2.listenloop.com/api/v1/public/organizations/ 574 B
1 KB 662ms
141ms XHR
application/json 3.232.27.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/organizations/me?public_key=MRxJc5qdz5T-wKxBNsh4
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.232.27.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-27-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628

Request headers

Accept: */*
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Runtime: 0.005171
Date: Fri, 19 Jun 2020 07:52:42 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"eeb810c8fe6152524f6e02e85774c1b2"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 361
X-Request-Id: 7bac6a40-bac5-4997-9040-d935e1d6872e

POST
H/1.1 200
OK retargeting_segments Show response
abm2.listenloop.com/api/v1/public/ 27 B
760 B 677ms
145ms XHR
application/json 3.232.27.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/retargeting_segments
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.232.27.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-27-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0

Request headers

Accept: */*
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

X-Runtime: 0.005580
Date: Fri, 19 Jun 2020 07:52:42 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"a62080c3dfacbb99a00c1f8e607acd31"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 53
X-Request-Id: 2d687c56-3a69-4433-9b0d-d0bb46201625

GET
H2 200 /
www.google.com/pagead/1p-user-list/968899429/ 42 B
148 B 20ms
20ms Image
image/gif 2a00:1450:4001:825::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/968899429/?random=1592553162273&cv=9&fst=1592550000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6a0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&tiba=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=1153085199&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 19 Jun 2020 07:52:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/968899429/ 42 B
153 B 21ms
20ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/968899429/?random=1592553162273&cv=9&fst=1592550000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6a0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&tiba=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=1153085199&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 19 Jun 2020 07:52:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET 124afbfb-36d2-4ce6-af1b-2014bc2ea144
https://www.fireeye.com/ 0
0

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 28 KB
7 KB 627ms
449ms Stylesheet
text/css 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:20 GMT
status: 200
etag: "1544639720"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 6591

GET
H2 200 css
fonts.googleapis.com/ 5 KB
1 KB 33ms
14ms Stylesheet
text/css 2a00:1450:4001:816::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d32996520262a9559a26eafe3413cf1a2fe53f448da989d0493e7851f887a1b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 19 Jun 2020 06:11:54 GMT
server: ESF
date: Fri, 19 Jun 2020 07:52:42 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 19 Jun 2020 07:52:42 GMT

GET
H2 200 sp.js Show response
cdn.pathfactory.com/sp/2.14.0/ 98 KB
30 KB 751ms
268ms Script
application/javascript 13.226.154.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pathfactory.com/sp/2.14.0/sp.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.154.118 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-154-118.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 50cf303cfaa020fcbedd6ad1bf045a008cbb88dfc792f731f07235dd1ca13599

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 10 Jun 2020 01:07:20 GMT
content-encoding: gzip
last-modified: Wed, 06 May 2020 07:53:19 GMT
server: AmazonS3
age: 801923
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=315360000
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: CtmAhvDOUJfBLfBpkmln6mwJXnECAHqQNMHzDsJ-4cJOS5P3cl_j5g==
via: 1.1 f12c01365a7e1bcbb4b6d5b856516527.cloudfront.net (CloudFront)

GET
H2 200 website_experience Show response
jukebox.pathfactory.com/api/public/v1/ 4 KB
2 KB 222ms
222ms XHR
application/json 34.227.185.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=&title=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&image=https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.227.185.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-227-185-217.compute-1.amazonaws.com

Software

Resource Hash

54808c411facb7ef4688f3218f445d6f523a2aa9cc3403bda1d973ef186a18ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.077348
date: Fri, 19 Jun 2020 07:52:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
etag: W/"54808c411facb7ef4688f3218f445d6f"
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
x-request-id: 8e6ee92a-8216-41ef-bc06-96f5535ea9da

GET
H2

200

/
cx.atdmt.com/
Redirect Chain

https://www.facebook.com/tr/?id=1847206522249226&ev=Microdata&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&...
https://cx.atdmt.com/?c=6145699801493334693&f=AYx3GuVa2QIiznM5JMN_C1AjxFp_F2zfcvIe9A2o6d9eRJGsmIizWJ9zRFjm9Ft_Qh2MNWCGhW_onPamN6Is5sxp&id=1847206522249226&l=3&v=0

43 B
448 B

100ms
84ms

Image
image/gif

2a03:2880:f01c:8004:face:b00c:0:8c
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cx.atdmt.com/?c=6145699801493334693&f=AYx3GuVa2QIiznM5JMN_C1AjxFp_F2zfcvIe9A2o6d9eRJGsmIizWJ9zRFjm9Ft_Qh2MNWCGhW_onPamN6Is5sxp&id=1847206522249226&l=3&v=0

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8004:face:b00c:0:8c , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
x-fb-debug: mUqfXtIqEQ1/vAZ6cnBUqTZm92Ak7YRmcH0UeZU6uh2Mg79LiDWYUcHIgQSjKHbiS95wVKDk/MZvD0MDFmpGfw==
content-encoding: br
x-content-type-options: nosniff
date: Fri, 19 Jun 2020 00:52:42 PDT, Fri, 19 Jun 2020 07:52:42 GMT
x-frame-options: DENY
content-type: image/gif
status: 200
cache-control: public, max-age=0
vary: Accept-Encoding
expires: Fri, 19 Jun 2020 00:52:42 PDT

Redirect headers

pragma: no-cache
date: Fri, 19 Jun 2020 07:52:42 GMT, Fri, 19 Jun 2020 07:52:42 GMT
server: proxygen-bolt
status: 302
content-type: text/plain
location: https://cx.atdmt.com/?c=6145699801493334693&f=AYx3GuVa2QIiznM5JMN_C1AjxFp_F2zfcvIe9A2o6d9eRJGsmIizWJ9zRFjm9Ft_Qh2MNWCGhW_onPamN6Is5sxp&id=1847206522249226&l=3&v=0
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=3600
content-length: 0
expires: 0

GET
H2 200 /
tr.lfeeder.com/ 43 B
291 B 59ms
38ms Image
image/gif 2600:9000:2182:9400:1a:2af:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=3P1w24dgrmJ7mY5n&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTM2Mzk0My0xIl0sImdhQ2xpZW50SWRzIjpbIjEyNzg0NDY1NzMuMTU5MjU1MzE2MiJdLCJjb250ZXh0Ijp7ImxpYnJhcnkiOnsibmFtZSI6ImxmdHJhY2tlciIsInZlcnNpb24iOiIxLjUuMCJ9LCJwYWdlVXJsIjoiaHR0cHM6Ly93d3cuZmlyZWV5ZS5jb20vYmxvZy9wcm9kdWN0cy1hbmQtc2VydmljZXMvMjAxOS8wOC9maXJlZXllLWFkZHMtd2ViLXNoZWxsLWRldGVjdGlvbi10by1wcm90ZWN0LXNlcnZlcnMuaHRtbCIsInBhZ2VUaXRsZSI6IkZpcmVFeWUgQWRkcyBXZWIgU2hlbGwgRGV0ZWN0aW9uIHRvIFByb3RlY3QgU2VydmVycyB8IEZpcmVFeWUgSW5jIiwicmVmZXJyZXIiOiIifSwiZXZlbnQiOiJ0cmFja2luZy1ldmVudCIsImNsaWVudFRpbWVzdGFtcCI6IjIwMjAtMDYtMTlUMDc6NTI6NDIuNzc0WiIsImNsaWVudFRpbWV6b25lIjotMTIwLCJzY3JpcHRJZCI6IjNQMXcyNGRncm1KN21ZNW4iLCJjb29raWVzRW5hYmxlZCI6dHJ1ZSwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuYjU3NWZhNzI1NmUzZGI4ZS4xNTkyNTUzMTYyNzczIiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fX0=
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2182:9400:1a:2af:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:42 GMT
via: 1.1 962c9e2b0aa7dee39ccec2b38fda120f.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: DUS51-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
status: 200
content-length: 43
x-amz-cf-id: ee6RWunb4lL2zfjdAcP9357oaHuxhTgHQVSlmZVE0rcqF7ppl5s3pw==

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

43 B
793 B

67ms
67ms

Image
image/gif

34.251.7.133
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.251.7.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-251-7-133.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
Date: Fri, 19 Jun 2020 07:52:44 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1
Date: Fri, 19 Jun 2020 07:52:43 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 14 KB
7 KB 259ms
87ms Script
application/javascript 23.10.73.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/6si.min.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.10.73.123 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-10-73-123.deploy.static.akamaitechnologies.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 5535d2c567dac9fb9a8eb888a5415164e87c4aa6f08f70a6cc6ab1c0cd3bac12

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 19 Jun 2020 07:52:43 GMT
Content-Encoding: gzip
Last-Modified: Sun, 12 Apr 2020 02:02:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e9276ac-3997"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 6031

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 fireicons.woff
www.fireeye.com/content/dam/fireeye-www/fw/f/ 72 KB
36 KB 24ms
23ms Font
application/x-font-woff 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rk

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
Origin: https://www.fireeye.com

Response headers

x-dispatcher: dispatcher1uswest1
date: Fri, 19 Jun 2020 07:52:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 29425
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 36804
cf-request-id: 036d29e12a00003244e697c200000001
last-modified: Tue, 24 Sep 2019 21:47:18 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-font-woff
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac151eb23244-FRA

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 getForm Show response
www2.fireeye.com/index.php/form/ 8 KB
2 KB 102ms
101ms Script
application/javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www2.fireeye.com/index.php/form/getForm?munchkinId=848-DID-242&form=3353&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&callback=jQuery11240498345927977353_1592553163185&_=1592553163186
Requested by: Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.74.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 194fdd8f363f677471a4d28a322da26491ad1c24418a91c3722a3fe30f4dcd16

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:43 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cf-request-id: 036d29e1dc0001006b2120e200000001
cf-ray: 5a5bac162c1d0000-ARN
cached: true

POST
H2 200 page_views Show response
jukebox.lookbookhq.com/api/public/v1/ 153 B
658 B 214ms
213ms XHR
application/json 34.200.197.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.lookbookhq.com/api/public/v1/page_views

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.200.197.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-200-197-210.compute-1.amazonaws.com

Software

Resource Hash

5c759c4d85298faf666f788e20554ceee6b9792a8faa9c0d016bd447ef531db2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.072769
date: Fri, 19 Jun 2020 07:52:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
etag: W/"5c759c4d85298faf666f788e20554cee"
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
x-request-id: a9e9692e-c153-45dd-959b-cc217f8f7013

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 194ms
66ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:43 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: FBAF69B7861DE212
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=19036
accept-ranges: bytes
content-length: 948
x-amz-id-2: mINJDBnKUfP83RzDJ6hQaYSGPvMPOM770jd+gXVSD8LFScfPdVPaVzI4W2IwmrtEKhDna93Nv9A=

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/158/ 11 KB
5 KB 67ms
67ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/158/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.60.75 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5f967fd41346c0fc1b9b44fa69c52bf1e754420c59c8017cefb0a14a764cafa4

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 19 Jun 2020 07:52:43 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 03:01:21 GMT
Server: AkamaiNetStorage
ETag: "67df7eb9e9e68638308f14367dddec10:1580180481"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4686
Expires: Sun, 27 Sep 2020 07:52:43 GMT

GET
H2 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 771 B
979 B 33ms
33ms XHR
application/vnd.maxmind.com-country+json 2606:4700::6810:252f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:252f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2faa2d1af1eaad26bd07229b783b755311597fb6adda228b9035a42aee5d916

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:43 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 5a5bac16e8a4177e-FRA
content-length: 771
cf-request-id: 036d29e24d0000177e6d9f9200000001

GET
H2 200 segmentation.segment.js Show response
www.fireeye.com/etc/ 0
139 B 24ms
23ms XHR
application/x-javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/segmentation.segment.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Fri, 19 Jun 2020 07:52:43 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 24653
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 0
cf-request-id: 036d29e24f00003244e69a6200000001
cf-bgj: minify
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "d41d8cd98f00b204e9800998ecf8427e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a5bac16ea8c3244-FRA

GET
H2 403 stores.init.js Show response
www.fireeye.com/etc/clientcontext/default/content/jcr:content/ 3 KB
1 KB 21ms
21ms XHR
text/html 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers&_=1592553161341

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7922239a839317e14fe00f800c18c482c7cb3c3e0327583d054d8b955e40b698

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:43 GMT
content-encoding: gzip
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 403
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 5a5bac16faa13244-FRA
cf-request-id: 036d29e25600003244e69a8200000001
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 read-blogentries Show response
www.fireeye.com/bin/www-blogs/ 32 KB
6 KB 746ms
746ms XHR
text/plain 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/bin/www-blogs/read-blogentries?categoryPath=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fproducts-and-services

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b19744c449fa66030418df4929feba95e5fa838208de14d79ffc2edd66437b66

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Fri, 19 Jun 2020 07:52:44 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 5605
x-xss-protection: 1; mode=block
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id: 036d29e25600003244e69a9200000001
cf-ray: 5a5bac16faa33244-FRA

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 98F8 0
0

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 275ms
166ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 106
pragma: no-cache
last-modified: Fri, 19 Jun 2020 07:52:44 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 8b35894f8c5540c817ca38e60ed455d5
x-transaction: 00ce8560006ece5e
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK MultiNoun.jsonp Show response
d.la2c2.salesforceliveagent.com/chat/rest/System/ 226 B
592 B 629ms
157ms Script
text/javascript 13.108.250.135
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la2c2.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.108.250.135 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl6-ord.la1-c2-ord.salesforceliveagent.com

Software

Resource Hash

af3fd650a7c04494dd0f5a4880f753b29f4c175512d6dbcffcd9ac060c5a9802

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: close
Expires: -1

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/fewebadmin/ 3 KB
958 B 190ms
188ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/fewebadmin/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4e040b6884ad0623aece79feb28b75ee490c568a930c6bbfd83255d058d54611

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:44 GMT
content-encoding: gzip
etag: 2015823830--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=8, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 782

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 89 B
249 B 233ms
232ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5eec6ecb80085c5e&bkl=0&bl=1&pdt=894&sid=5eec6ecb80085c5e&pub=fewebadmin&rev=v8.28.6-wp&ln=en&pc=men&cb=0&ab=-&dp=www.fireeye.com&fp=blog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=0&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1592553164116&jsl=8193&uvs=5eec6ecb7ea99875000&skipb=1&callback=addthis.cbs.jsonp__63034736226940910
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0941ee8feace493a69c546c49ba443a5461f4ec76302b02df11d50ba2be72943

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Fri, 19 Jun 2020 07:52:44 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 89
content-type: application/javascript;charset=utf-8

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 51B5 0
0 91ms
91ms Document
text/html 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 09 Sep 2019 15:34:57 GMT
etag: W/"5d767121-1115f"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 25412
date: Fri, 19 Jun 2020 07:52:44 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

POST
H2 204 create_event Show response
jukebox.lookbookhq.com/api/public/v1/page_views/ 0
378 B 147ms
147ms XHR
text/plain 34.200.197.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.lookbookhq.com/api/public/v1/page_views/create_event

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.200.197.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-200-197-210.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.007710
date: Fri, 19 Jun 2020 07:52:44 GMT
x-content-type-options: nosniff
status: 204
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
vary: Origin
x-request-id: 4ae41287-2fe8-4b57-9d79-bcfce97b23bc

GET
H2 200 conversion.js Show response
s.yimg.jp/images/listing/tool/cv/ 4 KB
2 KB 941ms
311ms Script
application/javascript 183.79.249.124
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 183.79.249.124 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),
Reverse DNS
Software: ATS /
Resource Hash: e55596fc1c3349cbbc926529c29c27e1de7b98b47a31cc7bb4789970e571065f

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Fri, 19 Jun 2020 07:44:37 GMT
content-encoding: gzip
last-modified: Thu, 29 Aug 2019 10:27:08 GMT
server: ATS
age: 487
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public, max-age=600
accept-ranges: bytes
content-type: application/javascript
content-length: 1421
via: http/1.1 edge2267.img.umd.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge2252.img.umd.yahoo.co.jp (ApacheTrafficServer [cRs f ])
expires: Fri, 19 Jun 2020 07:54:37 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
371 B 258ms
83ms XHR
text/plain 23.10.73.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.10.73.123 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-10-73-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: adda5e32fbc7aa8d9ac899233b88e644fa88f03ab04f5d959d057e092a9c2fec

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 19 Jun 2020 07:52:44 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.fireeye.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 475ms
302ms Image
image/gif 23.10.73.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=&visitor=5e35af4a-340c-4717-8d61-04566117e174&session=0edbba23-f14f-4eeb-8d9a-e9fea31ffa20&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22FireEye%20web%20shell%20detection%20is%20available%20in%20the%208.3.0%20release%20of%20FireEye%20Network%20Security.%5Cn%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc%22%7D&cb=53164180&r=&thirdParty=%7B%7D

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.10.73.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-10-73-123.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 19 Jun 2020 07:52:44 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:51:25 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e5026ad-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 forms2.css
www2.fireeye.com/js/forms2/css/ 13 KB
3 KB 43ms
42ms Stylesheet
text/css 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7188
status: 200
content-length: 2610
cf-request-id: 036d29e5a60001006b2124a200000001
last-modified: Wed, 27 May 2020 19:45:35 GMT
server: cloudflare
etag: "201e0f-33f8-5a6a674a055c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5a5bac1c38790000-ARN
expires: Fri, 19 Jun 2020 11:52:44 GMT

GET
H2 200 forms2-theme-simple.css
www2.fireeye.com/js/forms2/css/ 826 B
436 B 41ms
41ms Stylesheet
text/css 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2-theme-simple.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7188
status: 200
vary: Accept-Encoding
content-length: 242
cf-request-id: 036d29e5a60001006b2124b200000001
last-modified: Wed, 27 May 2020 19:45:35 GMT
server: cloudflare
etag: "201e15-33a-5a6a674a055c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5a5bac1c387c0000-ARN
expires: Fri, 19 Jun 2020 11:52:44 GMT

GET
H/1.1 200
OK visitWebPage Show response
848-did-242.mktoresp.com/webevents/ 2 B
304 B 1044ms
205ms XHR
text/plain 192.28.147.68
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL: https://848-did-242.mktoresp.com/webevents/visitWebPage?_mchNc=1592553164192&_mchCn=&_mchId=848-DID-242&_mchTk=_mch-fireeye.com-1592553164192-34241&_mchHo=www.fireeye.com&_mchPo=&_mchRu=%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&_mchPc=https%3A&_mchVr=158&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.147.68 , United States, ASN53580 (MARKETO, US),
Reverse DNS
Software: akka-http/10.1.11 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 19 Jun 2020 07:52:45 GMT
Content-Encoding: gzip
Server: akka-http/10.1.11
Transfer-Encoding: chunked
X-Request-Id: 15432915-de9e-4e63-9fd3-65439ad9ae69
Content-Type: text/plain; charset=UTF-8

GET
H2 200 collect
www.google-analytics.com/ 35 B
130 B 6ms
6ms Image
image/gif 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j83&a=1183127167&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&ul=en-us&de=UTF-8&dt=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20views%20with%20form&ea=view&el=Form&_u=aHDAAEAB~&jid=&gjid=&cid=1278446573.1592553162&tid=UA-363943-1&_gid=1253527829.1592553162&gtm=2wg6a0MVGC8KK&cd3=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&cd17=Form&cd18=3353&cd19=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&z=756522269

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jun 2020 12:00:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 762741
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 XDFrame Show response
www2.fireeye.com/index.php/form/ Frame A715 2 KB
887 B 202ms
201ms Document
text/html 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/index.php/form/XDFrame

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: www2.fireeye.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=de6fb53b5481981e416d7125ae35f55151592553160; _gcl_au=1.1.29066816.1592553162; _ga=GA1.2.1278446573.1592553162; _gid=GA1.2.1253527829.1592553162; _gat_UA-363943-1=1; _uetsid=85ff0868-5d85-bc30-470e-21336e7e1c65; _uetvid=859ac6c3-1180-2cb7-4bae-ace7138024e5; _fbp=fb.1.1592553162213.754618275; __cf_bm=59e01e0e844832a2598571ff359b0a41ad314534-1592553162-1800-AYDPeqhcBa/XKjXtJPn7SSSQChRs1loaq3wtpsSK30sZfC3EU3mD4eJBg7S3a5j83Fw/51FX4RiP6vhCobqNxjA=; _lfa=eyIzUDF3MjRkZ3JtSjdtWTVuIjoiTEYxLjEuYjU3NWZhNzI1NmUzZGI4ZS4xNTkyNTUzMTYyNzczIn0%3D; vid=49e9a159-3f48-4e7f-8463-5906b0193db4; _mkto_trk=id:848-DID-242&token:_mch-fireeye.com-1592553164192-34241; _sp_ses.81ef=*; _sp_id.81ef=fe7427cd-f670-4ba8-86af-54b473041e30.1592553164.1.1592553164.1592553164.8d1b0575-0b94-4a08-a782-573a5c26c1b3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Response headers

status: 200
date: Fri, 19 Jun 2020 07:52:44 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=3600
x-content-type-options: nosniff
vary: Accept-Encoding
set-cookie: BIGipServersjiweb-nginx-app_https=!sIxwdxM/BfnfDpTInuzRy4alk/3R/kJlbn9hGnEGUCw2NGJlAqXU2hW+CReo3QiHhBoAOEOjRWHZblQ=;Path=/;Version=1;Secure;Httponly
cf-cache-status: DYNAMIC
cf-request-id: 036d29e60b0001006b21251200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5a5bac1cd9ac0000-ARN
content-encoding: gzip

POST
H/1.1 200
OK page_views Show response
abm2.listenloop.com/api/v1/public/ 366 B
956 B 1586ms
1586ms XHR
application/json 3.232.27.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/page_views
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.232.27.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-27-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 073501761a5f06d31fd0d611f37bd15dd1f9ddd274045070b7b99fa40d21a566

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

X-Runtime: 1.445290
Date: Fri, 19 Jun 2020 07:52:46 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"6981f2b2f74a18f0fb00e84b329caaaa"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 248
X-Request-Id: 157211b5-0c4d-4233-a7d7-45fb46f39109

GET
H2 200 layers.ab5cd98fe1b9a38a4a9f.js Show response
s7.addthis.com/static/ 263 KB
76 KB 63ms
63ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Wed, 18 Sep 2019 14:16:17 GMT
server: nginx/1.15.8
etag: W/"5d823c31-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Fri, 19 Jun 2020 07:52:44 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77528

GET
H2 200 details Show response
epsilon.6sense.com/v1/company/ 644 B
593 B 168ms
58ms XHR
application/json 52.57.146.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v1/company/details
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.146.39 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-146-39.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 6387becf362b6b6381bb724aef17bb30cf76fcfeb75fbc0121d29ff9a75d12da

Request headers

Authorization: Token 325d6d60e24c7cfc3a782839d85ce08c8d3bb27c
Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
EpsilonCookie: null

Response headers

date: Fri, 19 Jun 2020 07:52:44 GMT
content-encoding: gzip
server: nginx/1.16.0
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.fireeye.com
access-control-allow-credentials: true
content-length: 404

GET
H2 200 forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ Frame A715 203 KB
68 KB 43ms
42ms Script
application/x-javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30b92b1d67692c95ef6d322b21cb9e0c2f7d5a4c68c05b4e3e3e87489ec41309

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://www2.fireeye.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6823
status: 200
vary: Accept-Encoding
cf-request-id: 036d29e6db0001006b21264200000001
last-modified: Sat, 06 Jun 2020 07:41:36 GMT
server: cloudflare
etag: "4617e8-32dcc-5a76581e289b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 5a5bac1e2bca0000-ARN
expires: Fri, 19 Jun 2020 11:52:44 GMT

GET
H/1.1 200
OK MultiNoun.jsonp Show response
d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/ 496 B
759 B 1112ms
400ms Script
text/javascript 13.110.66.53
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.110.66.53 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl3-ncg1-c6-iad5.la1-c1-ia5.salesforceliveagent.com

Software

Resource Hash

8aa74a449e0c8866b0af30fc31e52c1ffb3c9fc1ae203e283167794d263c0289

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: close
Expires: -1

GET
H/1.1 200
OK /
b91.yahoo.co.jp/pagead/conversion/1000244663/ 42 B
909 B 1237ms
363ms Image
image/gif 183.79.255.28
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b91.yahoo.co.jp/pagead/conversion/1000244663/?random=1592553165102&cv=9&fst=1592553165102&num=1&fmt=3&value=0&label=ppcGCKvb3mcQ_c2swgM&guid=ON&disvt=true&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&tiba=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

183.79.255.28 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),

Reverse DNS

Software

ATS /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 19 Jun 2020 07:52:46 GMT
Via: http/1.1 mscedge2102.img.umd.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options: nosniff
Server: ATS
Timing-Allow-Origin: *
Age: 0
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: no-cache, must-revalidate, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 14 KB
6 KB 56ms
18ms Script
application/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

5b54138a1228bb354b4d200ba40bca6e8bf05c3476b3013daf8fa8162a414582

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Fri, 19 Jun 2020 07:02:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3039
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 5398
x-amz-id-2: nhieLnhcX3YmHuQRFCGIgsAdd2tTFruf+/CmALpFMlvjQbHLnqVEGuIApjWuCKgqAIenwuYQh6g=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sun, 23 May 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Fri, 17 Apr 2020 10:13:12 GMT
server: ATS
etag: "262ad28777cd04301eaf1ed832269103-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 6C042AC985F53E62
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: .3pslEVav9FDmkNX3peqHq9djDal2LXy
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 json Show response
fireeye.tt.omtrdc.net/m2/fireeye/mbox/ 5 KB
1004 B 242ms
75ms XHR
application/json 54.76.90.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fireeye.tt.omtrdc.net/m2/fireeye/mbox/json?mbox=target-global-mbox&mboxSession=17241f68b7f542909601bdf51020c4aa&mboxPC=&mboxPage=07dcfcb4cb704878b502a08309bcc6e0&mboxRid=b357bc9fd5174995a675bda931e1e701&mboxVersion=1.7.1&mboxCount=1&mboxTime=1592560365150&mboxHost=www.fireeye.com&mboxURL=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&companyRevenueRange=%245B%2B&companyCountry=Sweden&companyIndustry=Transportation%20and%20Logistics&companyName=American%20Airlines&companyRegion=Northern%20Europe&companyDomain=aa.com&segments=%5B%22FireEye%20Top%20Accounts%20WorldWide%22%2C%22FY2020%20Security%20Effectiveness%20Intent%22%2C%22Intent%20%7C%20Email%20Security%20%7C%20Generic%22%5D
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.90.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-90-77.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 716615ca4d2805f76ec86082d9fe81b07636a7e96f76e83207ddb2a0325a38b6

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 19 Jun 2020 07:52:45 GMT
content-encoding: gzip
status: 200
vary: Origin,Accept-Encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.fireeye.com
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: b357bc9fd5174995a675bda931e1e701

GET
H2 200 435600.json Show response
s.yimg.com/wi/config/ 2 B
495 B 52ms
17ms XHR
application/json 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/435600.json

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2704
status: 200
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
x-amz-request-id: 2D285E4D28F810C3
x-amz-id-2: OYT7EFtO68IBqsarz4SUKLqem2OJfsZpZJfbQiXBBIUck056Sj4J47mQSK82SCnOojZCSZjrkRw=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 22

GET
H2 200 sp.pl Show response
sp.analytics.yahoo.com/ 0
528 B 226ms
74ms Script
application/x-javascript 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2019%20Jun%202020%2007%3A52%3A45%20GMT&n=-2d&b=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&.yp=435600&f=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&enc=UTF-8

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 19 Jun 2020 07:52:45 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: ATS
x-frame-options: DENY
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: application/x-javascript
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
expires: Fri, 19 Jun 2020 07:52:45 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
96 B 6ms
6ms Image
image/gif 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j83&a=1183127167&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&ul=en-us&de=UTF-8&dt=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Site%20Section&ea=FireEye%20Blogs&el=FireEye%20Stories&ev=0&_u=aHDAAEAB~&jid=&gjid=&cid=1278446573.1592553162&tid=UA-363943-1&_gid=1253527829.1592553162&gtm=2wg6a0MVGC8KK&z=1798479852

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jun 2020 12:00:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 762743
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
90 B 6ms
6ms Image
image/gif 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j83&a=1183127167&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&ul=en-us&de=UTF-8&dt=FireEye%20Adds%20Web%20Shell%20Detection%20to%20Protect%20Servers%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20Scroll&ea=25&el=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fproducts-and-services%2F2019%2F08%2Ffireeye-adds-web-shell-detection-to-protect-servers.html&_u=aHDAAEAB~&jid=&gjid=&cid=1278446573.1592553162&tid=UA-363943-1&_gid=1253527829.1592553162&gtm=2wg6a0MVGC8KK&z=896478495

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jun 2020 12:00:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 762743
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.fireeye.com
URL: blob:https://www.fireeye.com/124afbfb-36d2-4ce6-af1b-2014bc2ea144

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

193 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

32 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fireeye.com/	1969-12-31 23:59:59	Name: liveagent_sid Value: 65b0b345-55d1-4207-a1fa-509d0c1172c4
.addthis.com/	1970-01-19 19:51:21	Name: loc Value: MDAwMDBFVVNFMFMyMzkxMTkyOTE3ODAwMDBDSA==
.fireeye.com/	1970-01-19 10:22:35	Name: mboxEdgeCluster Value: 37
.fireeye.com/	1970-01-20 03:56:37	Name: mbox Value: session#17241f68b7f542909601bdf51020c4aa#1592555026\|PC#17241f68b7f542909601bdf51020c4aa.37_0#1655797966
www2.fireeye.com/	1969-12-31 23:59:59	Name: BIGipServersjiweb-nginx-app_https Value: !sIxwdxM/BfnfDpTInuzRy4alk/3R/kJlbn9hGnEGUCw2NGJlAqXU2hW+CReo3QiHhBoAOEOjRWHZblQ=
.fireeye.com/	1969-12-31 23:59:59	Name: check Value: true
www.fireeye.com/	1970-01-19 19:51:21	Name: __atuvc Value: 1%7C25
www.fireeye.com/	1970-01-23 02:01:25	Name: liveagent_ptid Value: 28219f99-f3b3-455f-b2ba-1ad71c26a5bc
www.fireeye.com/	1970-01-23 02:01:25	Name: liveagent_vc Value: 3
www.fireeye.com/	1970-01-20 03:53:45	Name: _gd_svisitor Value: 1a497b5cf9320000cb6eec5ee8000000ca960100
.fireeye.com/	1970-01-19 10:22:34	Name: _sp_ses.81ef Value: *
www.fireeye.com/	1970-01-20 03:53:45	Name: _gd_visitor Value: 5e35af4a-340c-4717-8d61-04566117e174
.fireeye.com/	1970-01-20 03:53:45	Name: _mkto_trk Value: id:848-DID-242&token:_mch-fireeye.com-1592553164192-34241
www.fireeye.com/	1970-01-19 10:22:47	Name: _gd_session Value: 0edbba23-f14f-4eeb-8d9a-e9fea31ffa20
.fireeye.com/	1970-01-20 03:53:45	Name: vid Value: 49e9a159-3f48-4e7f-8463-5906b0193db4
.fireeye.com/	1970-01-20 03:53:45	Name: _sp_id.81ef Value: fe7427cd-f670-4ba8-86af-54b473041e30.1592553164.1.1592553164.1592553164.8d1b0575-0b94-4a08-a782-573a5c26c1b3
.fireeye.com/	1970-01-19 10:23:59	Name: _gid Value: GA1.2.1253527829.1592553162
www.fireeye.com/	1970-01-23 02:01:25	Name: liveagent_oref Value:
.fireeye.com/	1970-01-19 10:23:59	Name: _uetsid Value: 85ff0868-5d85-bc30-470e-21336e7e1c65
.fireeye.com/	1970-01-20 03:53:45	Name: _lfa Value: eyIzUDF3MjRkZ3JtSjdtWTVuIjoiTEYxLjEuYjU3NWZhNzI1NmUzZGI4ZS4xNTkyNTUzMTYyNzczIn0%3D
www.fireeye.com/	1970-01-19 10:22:34	Name: AWSELBCORS Value: F33FE3570E13943BCC35AAB1BBA4B9E9759295F2A331D300084D8CB4FB2D9AECD2D2702761467B8FDED98DC1DAFCCE6E48F8EBCAFDDB78546BDCC32DDC294428315B4CD6AA
.doubleclick.net/	1970-01-19 10:22:34	Name: test_cookie Value: CheckForPermission
.fireeye.com/	1970-01-19 10:22:33	Name: _gat_UA-363943-1 Value: 1
www.fireeye.com/	1970-01-19 10:22:34	Name: AWSELB Value: F33FE3570E13943BCC35AAB1BBA4B9E9759295F2A331D300084D8CB4FB2D9AECD2D2702761467B8FDED98DC1DAFCCE6E48F8EBCAFDDB78546BDCC32DDC294428315B4CD6AA
.fireeye.com/	1970-01-19 12:32:09	Name: _fbp Value: fb.1.1592553162213.754618275
.www2.fireeye.com/	1970-01-19 10:22:34	Name: __cf_bm Value: 59e01e0e844832a2598571ff359b0a41ad314534-1592553162-1800-AYDPeqhcBa/XKjXtJPn7SSSQChRs1loaq3wtpsSK30sZfC3EU3mD4eJBg7S3a5j83Fw/51FX4RiP6vhCobqNxjA=
.addthis.com/	1970-01-19 19:51:21	Name: uvc Value: 1%7C25
.fireeye.com/	1970-01-19 10:45:57	Name: _uetvid Value: 859ac6c3-1180-2cb7-4bae-ace7138024e5
.fireeye.com/	1970-01-20 03:53:45	Name: _ga Value: GA1.2.1278446573.1592553162
.fireeye.com/	1970-01-19 12:32:09	Name: _gcl_au Value: 1.1.29066816.1592553162
www.fireeye.com/	1970-01-19 10:22:34	Name: __atuvs Value: 5eec6ecb7ea99875000
.fireeye.com/	1970-01-19 11:05:45	Name: __cfduid Value: de6fb53b5481981e416d7125ae35f55151592553160

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [bugsnag] Loaded!
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: currentPagePath :: /blog/products-and-services/2019/08/fireeye-adds-web-shell-detection-to-protect-servers
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [object Object]
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [object Object]
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: 1278446573.1592553162
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	warning	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: AT: Failed actions [object Object],[object Object],[object Object],[object Object]

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8443343.fls.doubleclick.net
848-did-242.mktoresp.com
abm2.listenloop.com
analytics.twitter.com
app.cdn.lookbookhq.com
attr.ml-api.io
b.6sc.co
b91.yahoo.co.jp
bat.bing.com
c.6sc.co
c.la2c2.salesforceliveagent.com
cdn.pathfactory.com
cloud.typography.com
connect.facebook.net
cx.atdmt.com
d.la1-c1-ia5.salesforceliveagent.com
d.la2c2.salesforceliveagent.com
epsilon.6sense.com
fireeye.tt.omtrdc.net
fonts.googleapis.com
googleads.g.doubleclick.net
j.6sc.co
js.maxmind.com
jukebox.lookbookhq.com
jukebox.pathfactory.com
lftracker.leadfeeder.com
m.addthis.com
maxcdn.bootstrapcdn.com
munchkin.marketo.net
px.ads.linkedin.com
s.ml-attr.com
s.yimg.com
s.yimg.jp
s7.addthis.com
secure.adnxs.com
segment.prod.bidr.io
snap.licdn.com
sp.analytics.yahoo.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tr.lfeeder.com
v1.addthisedge.com
v2.listenloop.com
www.facebook.com
www.fireeye.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www2.fireeye.com
z.moatads.com
s7.addthis.com
www.fireeye.com
104.17.74.206
104.244.42.195
104.244.42.69
13.108.248.7
13.108.250.135
13.110.66.53
13.224.198.74
13.226.154.118
13.226.154.83
151.101.12.157
172.217.23.130
183.79.249.124
183.79.255.28
192.28.147.68
2001:4de0:ac19::1:b:1b
212.82.100.181
216.58.206.6
23.10.73.123
23.210.248.44
23.210.250.213
23.37.170.12
2600:9000:2182:9400:1a:2af:6d00:93a1
2606:4700:300b::a29f:f77d
2606:4700:3036::681b:9d96
2606:4700::6810:252f
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:f03d:1fa::4000
2a00:1450:4001:801::2008
2a00:1450:4001:802::2002
2a00:1450:4001:808::2003
2a00:1450:4001:816::200a
2a00:1450:4001:81d::200e
2a00:1450:4001:825::2004
2a00:1450:400c:c00::9b
2a02:26f0:eb:3b4::25ea
2a03:2880:f01c:8004:face:b00c:0:8c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
3.232.27.189
34.200.197.210
34.227.185.217
34.251.7.133
37.252.172.36
52.57.146.39
54.76.90.77
68.67.153.60
88.221.60.75
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
073501761a5f06d31fd0d611f37bd15dd1f9ddd274045070b7b99fa40d21a566
079c30478215da1e544443314dabb6ab1251fa2ae56447ace992ade3bbe3fd0c
0941ee8feace493a69c546c49ba443a5461f4ec76302b02df11d50ba2be72943
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
194fdd8f363f677471a4d28a322da26491ad1c24418a91c3722a3fe30f4dcd16
1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02
1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0
1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae
24b7b2f7b99ef95b2f4fbd89f372e734216c11d8467af0e795f354937b461e21
25985aa3209936e917d938425dae95783d44571ec6016c8b25cacab21e90af70
2a681cca9fc0504acacb6157248b780c9cbaff015575f4d30f5ab0756329ebeb
30b92b1d67692c95ef6d322b21cb9e0c2f7d5a4c68c05b4e3e3e87489ec41309
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de
353061679934adbd94e40e884dd4f85a7d74da808db2bf28e38d23db407a5e2e
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b
3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
48dca69d4a48f11abaa7e1a0d846cb4484c0c4fe7ca90552fa7483b1e53ab74b
4cb61e44bf63a9e090e666898cd04d382e4c33b55b62cc5e9ff7dab055fbf787
4e040b6884ad0623aece79feb28b75ee490c568a930c6bbfd83255d058d54611
4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca
5062a8070951a1c77103a1bb6d96a11f185c50e4ee7b317320a8588243f6d828
50cf303cfaa020fcbedd6ad1bf045a008cbb88dfc792f731f07235dd1ca13599
54808c411facb7ef4688f3218f445d6f523a2aa9cc3403bda1d973ef186a18ea
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5535d2c567dac9fb9a8eb888a5415164e87c4aa6f08f70a6cc6ab1c0cd3bac12
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628
5b54138a1228bb354b4d200ba40bca6e8bf05c3476b3013daf8fa8162a414582
5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d
5c5fa3187f5382e332df049161fd649a883eaa14577050ae26204d5f5b66c197
5c759c4d85298faf666f788e20554ceee6b9792a8faa9c0d016bd447ef531db2
5f967fd41346c0fc1b9b44fa69c52bf1e754420c59c8017cefb0a14a764cafa4
6387becf362b6b6381bb724aef17bb30cf76fcfeb75fbc0121d29ff9a75d12da
716615ca4d2805f76ec86082d9fe81b07636a7e96f76e83207ddb2a0325a38b6
757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a
7922239a839317e14fe00f800c18c482c7cb3c3e0327583d054d8b955e40b698
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
8aa74a449e0c8866b0af30fc31e52c1ffb3c9fc1ae203e283167794d263c0289
9b12e00d0e865f5138dc28999b4647c511f3aa135354dfb518f30e208682a622
9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd
a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9
a693efa7265b630e27e537f6ba09c5558a23b9ed2f57abdbf417c237a50a5156
ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adda5e32fbc7aa8d9ac899233b88e644fa88f03ab04f5d959d057e092a9c2fec
aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88
af3fd650a7c04494dd0f5a4880f753b29f4c175512d6dbcffcd9ac060c5a9802
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b19744c449fa66030418df4929feba95e5fa838208de14d79ffc2edd66437b66
b205100033a7fe4eff3d80cad57e9d50bccb731475d0f457130dd8788237ba0b
b237272f023f577721bdec0286b15f67e93c705be01c08bf037ae7d4738dcbb7
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
b6f7b31210a709daca9760b215660b2cbe719757df3059364beeda005fca2dbe
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
c36dd933050a2d18930871de47783867670d54c5adb9241d4f5ea802b246cc3a
c7d7214a0b940c1ffcbd64689a576c5847b42e886da3ad9ea45bc4cda214bac8
c91c97d78511fa85c181fd5f00e2b396893423a8389dc61703502dc1f772fa02
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
d20cf953b941d38ca8b450334f135fbe787dc4cb8371f4032fda9337cbfd5836
d32996520262a9559a26eafe3413cf1a2fe53f448da989d0493e7851f887a1b0
d4eae71ff47319b9bcb824e70dbfbe6da1be9fa875552c57e5fe557587010406
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e2faa2d1af1eaad26bd07229b783b755311597fb6adda228b9035a42aee5d916
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e55596fc1c3349cbbc926529c29c27e1de7b98b47a31cc7bb4789970e571065f
ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

www.fireeye.com Open in urlscan Pro 2606:4700:300b::a29f:f77d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

92 Requests

98 %HTTPS

41 %IPv6

42 Domains

54 Subdomains

45 IPs

9 Countries

2351 kBTransfer

5457 kBSize

32 Cookies

26 Outgoing links

Redirected requests

92 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f77d Public Scan

Screenshot
Live screenshot

Full Image

92
Requests

98 %
HTTPS

41 %
IPv6

42
Domains

54
Subdomains

45
IPs

9
Countries

2351 kB
Transfer

5457 kB
Size

32
Cookies

92 HTTP transactions
8 data transactions